CVE-2026-64151 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
iommupt: Check for missing PAGE_SIZE in the pgsize_bitmap
Sashiko pointed out that the driver could drop PAGE_SIZE from the pgsize_bitmap. That is technically allowed but nothing does it, and such an iommu_domain would not be used with the DMA API today.
Still, it is against the design and it is trivial to fix up. Lift the PT_WARN_ON to the if branch and just skip the fast path.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/19/2026
The vulnerability in question affects the Linux kernel's IOMMU (Input-Output Memory Management Unit) subsystem, specifically within the iommupt driver implementation. This issue stems from a design inconsistency where the pgsize_bitmap structure could potentially lose the PAGE_SIZE entry, violating established kernel design principles. The problem was identified through careful code analysis revealing that while the kernel technically permits removal of PAGE_SIZE from the pgsize_bitmap, no existing functionality actually performs this operation. However, this deviation from expected behavior creates potential security implications and operational risks within the memory management subsystem.
The technical flaw manifests in how the IOMMU driver handles page size bitmap validation during domain initialization and memory mapping operations. When PAGE_SIZE is removed from the pgsize_bitmap, the system enters an inconsistent state where the driver's fast path optimization logic becomes unreliable. The original implementation contained a PT_WARN_ON macro that was positioned incorrectly within the code structure, failing to properly validate the presence of PAGE_SIZE in the bitmap before proceeding with memory management operations. This misplacement meant that when PAGE_SIZE was indeed missing, the system would continue processing without proper error handling or fallback mechanisms.
The operational impact of this vulnerability extends beyond simple performance degradation to potential security risks within virtualized environments and systems utilizing IOMMU for device memory access control. When an iommu_domain operates without PAGE_SIZE in its pgsize_bitmap, it creates opportunities for memory mapping inconsistencies that could be exploited by malicious actors. The vulnerability particularly affects systems running with virtualization workloads where IOMMU is critical for maintaining memory isolation between virtual machines and host systems. Additionally, this issue can compromise DMA (Direct Memory Access) operations, potentially allowing unauthorized memory access patterns that violate security boundaries established by the kernel's memory management subsystem.
This vulnerability aligns with CWE-691, which addresses insufficient control flow management in software systems where proper validation of critical data structures is not maintained. The fix involves moving the PT_WARN_ON macro to the appropriate conditional branch and implementing a proper skip mechanism for the fast path when PAGE_SIZE is absent from the pgsize_bitmap. This approach ensures that all IOMMU domains maintain consistent page size bitmap configurations while preserving system functionality. The solution also references ATT&CK technique T1068, which covers exploiting weaknesses in privilege escalation through memory management subsystems, as this vulnerability could potentially be leveraged to bypass security controls around memory access permissions.
Mitigation strategies for this vulnerability begin with applying the upstream kernel patch that correctly positions the validation logic and implements proper fallback behavior. System administrators should prioritize updating kernel versions to include this fix, particularly in virtualized environments where IOMMU is actively utilized. Monitoring systems should be configured to alert on instances where IOMMU domains are created without proper page size bitmap configurations, as these could indicate potential exploitation attempts or misconfigurations. Organizations should also review their virtualization and containerization practices to ensure that device assignment and memory management policies properly account for IOMMU requirements. The fix essentially enforces the principle of least privilege in memory management by ensuring that all IOMMU domains maintain consistent page size configurations, preventing potential bypasses of memory access controls through the fast path optimization mechanism.