CVE-2026-64186 Linux CVE debrief

Who should care

Linux kernel users and administrators should be aware of this vulnerability and ensure that their systems are updated with the latest kernel patches. They should also review system logs for suspicious activity and implement compensating controls such as SELinux or AppArmor if necessary.

Technical summary

The AMD IOMMU debugfs implementation was vulnerable to out-of-bounds memory accesses. The variables dbg_mmio_offset and dbg_cap_offset were declared as int and populated using kstrtou32_from_user(). If a user provided a sufficiently large value, it could become a negative integer. The vulnerability was mitigated by replacing kstrtou32_from_user() with kstrtos32_from_user() and adding checks for negative values. The Linux kernel was found to have a latent out-of-bounds access vulnerability in the IOMMU debugfs.

Defensive priority

Medium

Recommended defensive actions

• Inventory Linux kernel versions and assess for exposure
• Apply kernel patches or updates provided by the Linux distribution
• Monitor system logs for suspicious activity
• Implement compensating controls such as SELinux or AppArmor
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-07-19T16:18:01.037Z and has not been modified since then. The NVD entry is currently Received. The Linux kernel was found to have a latent out-of-bounds access vulnerability in the IOMMU debugfs. This was due to the use of kstrtou32_from_user() which could result in a negative integer being used as an offset. The vulnerability has been resolved by replacing kstrtou32_from_user() with kstrtos32_from_user() and adding checks for negative values. The CVE record was created based on the supplied source corpus and may not reflect all available information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.