Linux Kernel CVE-2026-64292

The iommufd (I/O Memory Management Unit File Descriptor) subsystem manages IOMMU resources for virtual machine device passthrough and related isolation workloads. Within iommufd, the virtual event queue (veventq) mechanism allows user space to receive IOMMU events asynchronously; the veventq_depth parameter, which governs maximum queue entries, is user-supplied. The vulnerability arises because memory allocation for new queue entries was performed inside a spinlock using GFP_ATOMIC semantics. GFP_ATOMIC draws from a reserved memory pool intended for interrupt-context allocations that cannot sleep; when user space repeatedly triggers this path with large depth values, these reserves can be exhausted, starving legitimate interrupt handlers. CWE-401 (Missing Release of Memory after Effective Lifetime) characterizes the improper memory management lifecycle. The fix relocates the allocation outside the spinlock and substitutes GFP_NOWAIT, which fails fast under pressure without touching atomic reserves or invoking direct reclaim from threaded IRQ context. The CPE identifier cpe:2.3:a:linux:linux covers the affected codebase. The 'Buffer Overflow' tag in source intelligence is a mis-categorization; this is a memory exhaustion issue, not a spatial safety violation.