Skip to main content

Linux EUVDEUVD-2026-49005

| CVE-2026-64293 HIGH
2026-07-25 Linux GHSA-rq5j-2985-g74r
Information Disclosure Linux
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SUSE
HIGH
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 27, 2026 - 05:32 vuln.today
CVSS changed
Jul 27, 2026 - 05:22 NVD
7.8 (HIGH)
Patch available
Jul 25, 2026 - 11:18 EUVD
CVE Published
Jul 25, 2026 - 08:49 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 25, 2026 - 08:49 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read

The bound-check in iommufd_veventq_fops_read() for the normal vEVENT path uses sizeof(hdr) where the surrounding code uses sizeof(*hdr):

if (!vevent_for_lost_events_header(cur) && sizeof(hdr) + cur->data_len > count - done) {

hdr is declared as struct iommufd_vevent_header *, so sizeof(hdr) evaluates to the size of the pointer. Surrounding code uses sizeof(*hdr) consistently:

if (done >= count || sizeof(*hdr) > count - done) { ... if (copy_to_user(buf + done, hdr, sizeof(*hdr))) { ... done += sizeof(*hdr);

struct iommufd_vevent_header is currently 8 bytes (two __u32 fields, flags and sequence), so on 64-bit (sizeof(void *) == 8) the two expressions happen to be equal and the check works as intended.

On 32-bit (sizeof(void *) == 4) the check under-counts the header by 4 bytes: a vEVENT whose data_len causes 8 + cur->data_len to exceed count - done while 4 + cur->data_len does not will pass the check, then the loop will copy_to_user 8 bytes of header followed by data_len bytes of payload, writing past the user-supplied buffer.

It is also a latent bug for any future expansion of struct iommufd_vevent_header beyond sizeof(void *) on 64-bit; the check should not depend on the type happening to match the host pointer width.

Use sizeof(*hdr) to match the rest of the function and the actual amount that will be copied.

AnalysisAI

We are tasked to synthesize a comprehensive analysis for CVE-2026-64293. Need to output JSON.

Given data:

  • CVE ID: CVE-2026-64293
  • Description: long description about iommufd veventq read bug with sizeof(hdr) vs sizeof(*hdr). On 32-bit, under-counts header size, leading to buffer overflow past user-supplied buffer.
  • CVSS: 7.8, vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CWE: N/A (but we can infer CWE-131: Incorrect Calculation of Buffer Size? Or maybe CWE-682: Incorrect Calculation? Not given.)
  • EPSS: 0.21% (percentile 11%) — low exploitation probability.
  • Patch: Available from vendor.
  • Reported by: Linux (likely Linux kernel)
  • CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* (all versions)
  • Tags: Linux, Information Disclosure (though the vulnerability is actually a buffer overflow, but tags say Information Disclosure; perhaps they are generic tags, not precise)
  • ENISA EUVD ID: EUVD-2026-49005
  • Affected versions (EUVD): weird entries: "Linux patch: 7.1.4", "Linux 6.15", "Linux patch: 0", "Linux patch: 7.2-rc1", "Linux e36ba5ab808ef6237c3148d469c8238674230e2b <be93d186ae88a92e7aa77e122d4e661fa57b1e39", "Linux e36ba5ab808ef6237c3148d469c8238674230e2b <0cdbb97a4dbd69abdd2ab998b4fbc7803d4b0b72", "Linux e36ba5ab808ef6237c3148d469c8238674230e2b <04a177f91160ee18da98f5689482cf0f589ec869", "Linux patch: 6.18.39"
  • Looks like commit ranges and patch references. Need to interpret.
  • References: three kernel git commits, NVD link, vuldb link.

Analysis:

Product name: Linux kernel (specifically iommufd subsystem). So product_name: "Linux Kernel".

Summary: Must not copy description, write original synthesis. Buffer overflow in Linux kernel's iommufd subsystem, specifically in veventq read path due to sizeof(hdr) using pointer size instead of structure size, leading to potential memory corruption on 32-bit systems. Allowing local attackers with low privileges to gain elevated privileges or cause system compromise. CVSS 7.8 indicates local vector, low complexity, high im

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-49005 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy