CVE-2026-64186: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-64186 is a latent out-of-bounds memory access vulnerability in the AMD IOMMU debugfs subsystem of the Linux kernel. It affects the iommu_mmio_write() and iommu_capability_write() functions, where offset variables declared as int are populated via kstrtou32_from_user(), allowing a sufficiently large user-supplied value to wrap into a negative integer and potentially trigger out-of-bounds memory access. The vulnerability was published on July 19, 2026, and affects Linux kernel versions starting from 6.17 up to the patched commits. The CVSS base score is not yet formally assigned (estimated Medium severity) (GitHub Advisory, Feedly).

The root cause is an integer type mismatch (related to CWE-125: Out-of-bounds Read / CWE-787: Out-of-bounds Write) in the AMD IOMMU debugfs implementation. The variables dbg_mmio_offset and dbg_cap_offset are declared as signed int, but are populated using kstrtou32_from_user(), which parses an unsigned 32-bit integer. A large value (e.g., values between 2^31 and 2^32-1) causes the signed integer to become negative, potentially bypassing bounds checks and enabling out-of-bounds kernel memory access. While several existing mitigations (input length cap via OFS_IN_SZ, implicit type promotion in comparisons, and show handler checks) partially mitigated the risk, the fix replaces kstrtou32_from_user() with kstrtos32_from_user() and adds explicit negative-value checks in both write handlers (GitHub Advisory).

A local attacker with access to the AMD IOMMU debugfs interface could potentially read from or write to out-of-bounds kernel memory regions, which may lead to information disclosure or kernel memory corruption. Because debugfs access is typically restricted to privileged users (root or those with CAP_SYS_ADMIN), the practical impact is limited in well-configured systems. However, in environments where debugfs is exposed to less-privileged users or containers, exploitation could contribute to privilege escalation or kernel stability issues (GitHub Advisory, Feedly).

The fix has been applied in upstream Linux kernel commits 488d2c76bd9f (one stable branch), 62f9dfbf1ace (another stable branch), and 8dfd3d8d7443 (a third stable branch), with patched stable releases including Linux 6.18.34, 7.0.11, and 7.1. Users should update to these patched kernel versions as soon as available from their distribution. As a workaround, administrators can restrict or unmount the debugfs filesystem (umount /sys/kernel/debug) to eliminate the attack surface on sensitive systems (GitHub Advisory).