CVE-2026-64151

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64151", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T07:54:57.037Z", "datePublished": "2026-07-19T15:40:40.643Z", "dateUpdated": "2026-08-05T12:39:45.883Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:39:45.883Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommupt: Check for missing PAGE_SIZE in the pgsize_bitmap\n\nSashiko pointed out that the driver could drop PAGE_SIZE from the\npgsize_bitmap. That is technically allowed but nothing does it, and\nsuch an iommu_domain would not be used with the DMA API today.\n\nStill, it is against the design and it is trivial to fix up. Lift\nthe PT_WARN_ON to the if branch and just skip the fast path."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "baseScore": 8.4, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is in `map_range()` inside the generic IOMMU page-table path, reached only via local kernel interfaces (`iommu_map()` \u2192 `iommu_map_nosync()` \u2192 `pt->ops->map_range()`), primarily through `/dev/iommufd` or `/dev/vfio/*` ioctls during device passthrough mapping setup. There is no network-facing entry point.\nAC:L - Once an IOMMU paging domain exists with `PAGE_SIZE` cleared from `pgsize_bitmap`, any `iommu_map()`/`IOMMU_IOAS_MAP` call mapping a single page reliably takes the buggy fast path; the attacker controls mapping requests and needs no races or special memory layout.\nPR:L - Exploitation requires local ability to create IOMMU mappings for a passthrough device (IOMMUFD/VFIO ioctl access and device group permissions), which is available to unprivileged tenants on cloud GPU/NIC passthrough hosts without host root, even though opening `/dev/iommufd` alone is insufficient.\nUI:N - Triggering the flaw is entirely programmatic through IOMMU mapping ioctls; no victim interaction such as mounting a filesystem or opening a file is required.\nS:C - Incorrect leaf PTE installation on an IOMMU domain can break DMA isolation, allowing a device to read/write host physical memory outside its authorized mappings\u2014an IOMMU/DMA security-boundary bypass per kernel CVSS guidance.\nC:H - Malformed or policy-violating IOMMU page-table entries can cause a DMA-capable device to read arbitrary host physical memory beyond the intended IOVA window, constituting arbitrary memory disclosure through the IOMMU bypass primitive.\nI:H - The fast path installs `PAGE_SHIFT` leaf entries even when `PAGE_SIZE` is excluded from `pgsize_bitmap`, corrupting IOMMU translation state and enabling a DMA device to write to unauthorized host physical pages.\nA:N - The flaw corrupts IOMMU translation entries rather than causing a kernel oops, panic, or hang; availability impact is not a primary or reliable outcome of triggering this bug."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/iommu/generic_pt/iommu_pt.h"], "versions": [{"version": "dcd6a011a8d523a114af2360a8753de5bd60c139", "lessThan": "00850f41da24423587abd6124a790dd4f12bcef3", "status": "affected", "versionType": "git"}, {"version": "dcd6a011a8d523a114af2360a8753de5bd60c139", "lessThan": "8ef3f77c440005c7f04229a75976bfc078364247", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/iommu/generic_pt/iommu_pt.h"], "versions": [{"version": "6.19", "status": "affected"}, {"version": "0", "lessThan": "6.19", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.11", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.0.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/00850f41da24423587abd6124a790dd4f12bcef3"}, {"url": "https://git.kernel.org/stable/c/8ef3f77c440005c7f04229a75976bfc078364247"}], "title": "iommupt: Check for missing PAGE_SIZE in the pgsize_bitmap", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/iommu/generic_pt/iommu_pt.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "00850f41da24423587abd6124a790dd4f12bcef3", "status": "affected", "version": "dcd6a011a8d523a114af2360a8753de5bd60c139", "versionType": "git"}, {"lessThan": "8ef3f77c440005c7f04229a75976bfc078364247", "status": "affected", "version": "dcd6a011a8d523a114af2360a8753de5bd60c139", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/iommu/generic_pt/iommu_pt.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.19"}, {"lessThan": "6.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0520D091-FC52-4A50-AF07-70AE7D08B750", "versionEndExcluding": "7.0.11", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*", "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*", "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommupt: Check for missing PAGE_SIZE in the pgsize_bitmap\n\nSashiko pointed out that the driver could drop PAGE_SIZE from the\npgsize_bitmap. That is technically allowed but nothing does it, and\nsuch an iommu_domain would not be used with the DMA API today.\n\nStill, it is against the design and it is trivial to fix up. Lift\nthe PT_WARN_ON to the if branch and just skip the fast path."}], "id": "CVE-2026-64151", "lastModified": "2026-08-17T17:11:43.930", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 5.8, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-07-19T16:17:57.070", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/00850f41da24423587abd6124a790dd4f12bcef3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8ef3f77c440005c7f04229a75976bfc078364247"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: iommupt: Check for missing PAGE_SIZE in the pgsize_bitmap", "id": "2502513", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502513"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-358", "details": ["In the Linux kernel, the following vulnerability has been resolved:\niommupt: Check for missing PAGE_SIZE in the pgsize_bitmap\nSashiko pointed out that the driver could drop PAGE_SIZE from the\npgsize_bitmap. That is technically allowed but nothing does it, and\nsuch an iommu_domain would not be used with the DMA API today.\nStill, it is against the design and it is trivial to fix up. Lift\nthe PT_WARN_ON to the if branch and just skip the fast path.", "A flaw was found in the Linux kernel's IOMMU (Input/Output Memory Management Unit) page table driver. This vulnerability involves a missing check for the system's fundamental memory page size (PAGE_SIZE) within the pgsize_bitmap data structure. While an IOMMU configuration with this missing check would not typically be used with the Direct Memory Access (DMA) API, this design oversight could lead to unexpected system behavior or integrity issues."], "name": "CVE-2026-64151", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-07-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-64151\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-64151\nhttps://lore.kernel.org/linux-cve-announce/2026071931-CVE-2026-64151-1bcc@gregkh/T"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[dcd6a011a8d523a114af2360a8753de5bd60c139,00850f41da24423587abd6124a790dd4f12bcef3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[dcd6a011a8d523a114af2360a8753de5bd60c139,8ef3f77c440005c7f04229a75976bfc078364247)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.11,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-21T11:15:05.700979+00:00", "updated": "2026-08-17T22:00:03.862777+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}