Linux Kernel EUVD-2026-93210

Requires a PowerPC (ppc64) host running KVM PPC guest passthrough or VFIO with TCE IOMMU tables, where the attacker can invoke H_STUFF_TCE or H_PUT_TCE_INDIRECT with npages > 1 - the multi-page path whose npages argument was previously ignored (hardcoded to 1) in iommu_tce_check_ioba. Exploitation is strictly local (AV:L) and requires low-privileged but legitimate access (PR:L) to the guest hypercall or VFIO interface; it is not reachable remotely and does not apply to x86/ARM or to systems without PowerPC IOMMU passthrough configured. The narrow PowerPC virtualization prerequisite is the primary factor limiting real-world exploitability despite the high impact metrics.

The input CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, base 8.8) describes a local, low-privileged, scope-changing flaw with full confidentiality/integrity/availability impact - consistent with a KVM/VFIO guest or VFIO-capable process overflowing the IOMMU TCE table bounds check and affecting the host (scope change). However, the real-world risk is substantially lower than the 8.8 suggests: EPSS is only 0.18% (7th percentile), the flaw is NOT in CISA KEV, and no public exploit code is referenced. Exploitation status is therefore 'no public exploit identified at time of analysis.' A critical limiting factor absent from the CVSS vector is that this code path is PowerPC-specific (powerpc/iommu, H_STUFF_TCE / H_PUT_TCE_INDIRECT hypercalls) and only reachable where KVM PPC or VFIO TCE passthrough is in use - a narrow deployment slice. The low EPSS aligns with this: the flaw requires a specific architecture plus local authenticated access and is not amenable to mass remote exploitation. No signals conflict, but note CWE is listed as N/A in the input while the tag 'Buffer Overflow' and the description point to an arithmetic/bounds overflow (closer to CWE-190/CWE-787); treat the tag as indicative, not authoritative. Overall: a genuine privilege-boundary bug worth patching on PowerPC virtualization hosts, but not an urgent fleet-wide emergency.

A guest VM or a local process with VFIO/TCE access on a PowerPC host issues an H_PUT_TCE_INDIRECT or H_STUFF_TCE request with npages > 1 crafted so the range check in iommu_tce_check_ioba overflows, bypassing the table-capacity validation. This lets the attacker map or clear TCE entries outside the intended IOMMU table, corrupting host memory or DMA mappings and crossing the guest/host boundary (CVSS scope change). No public exploit code is referenced; attack complexity is low once local access to the hypercall/VFIO interface exists.