CVE-2026-98282 in Linux
Summary
by MITRE • 10/06/2026
In the Linux kernel, the following vulnerability has been resolved:
powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba
The commit b1af23d836f8 ("KVM: PPC: iommu: Unify TCE checking") unified IOBA parameter checking across KVM and VFIO into iommu_tce_check_ioba(). While doing so, the passed in argument npages is ignored and constant value '1' is used leaving out a possible overflow as the callers can legitimately be using npages > 1 for H_STUFF_TCE or H_PUT_TCE_INDIRECT cases.
Fix this by accounting for 'npages', checking for arithmetic overflow, and verifying that the entire requested range (ioba - offset + npages) does not exceed the table capacity 'size'.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/06/2026
The Linux kernel vulnerability identified in the powerpc IOMMU subsystem stems from a logical error introduced during code refactoring efforts aimed at unifying input validation logic. Specifically, commit b1af23d836f8 consolidated IOBA parameter checking for KVM and VFIO into a single function named iommu_tce_check_ioba to reduce redundancy and improve maintainability. However, this consolidation inadvertently introduced a critical flaw where the number of pages argument, npages, was ignored in favor of a hardcoded constant value of one. This oversight means that when callers invoke operations such as H_STUFF_TCE or H_PUT_TCE_INDIRECT with request sizes exceeding a single page, the validation logic fails to account for the full extent of the memory range being accessed. Consequently, the function does not properly verify whether the entire requested range exceeds the capacity of the TCE table, leaving the system vulnerable to arithmetic overflow conditions that can bypass intended security boundaries.
From a technical perspective, this flaw represents an integer overflow vulnerability where the calculation determining the end address of the I/O virtual memory area is incorrect because it assumes a fixed size rather than the dynamically provided page count. In systems utilizing PowerPC architecture with hardware-assisted translation lookaside buffers or similar IOMMU implementations, accurate boundary checks are essential to prevent out-of-bounds writes or reads into kernel memory structures managed by the TCE table. When npages is greater than one, the actual end address calculated as ioba minus offset plus npages can exceed the allocated size of the table without triggering an error condition within the flawed validation routine. This allows malicious or buggy guest virtual machines to map invalid physical addresses, potentially leading to memory corruption, privilege escalation, or denial of service conditions depending on how the kernel subsequently handles these out-of-bounds accesses.
The operational impact of this vulnerability is significant for environments running PowerPC-based systems with KVM or VFIO configurations that allow userspace applications to interact directly with IOMMU tables via hypercalls like H_PUT_TCE_INDIRECT. An attacker controlling a guest VM could exploit the lack of proper range validation to write TCE entries beyond the bounds of the allocated table, potentially overwriting adjacent kernel data structures such as page tables or other critical metadata. This aligns closely with CWE-190 Integer Overflow and CWE-787 Out-of-bounds Write vulnerabilities within the Common Weakness Enumeration framework. Furthermore, this exploitation path relates to ATT&CK technique T1499 Endpoint Denial of Service if used to crash the host kernel, or potentially T1055 Process Injection if the memory corruption allows for code execution control flow hijacking in more complex scenarios involving adjacent sensitive structures.
Mitigation strategies primarily involve applying the upstream Linux kernel patch that corrects this logic by properly incorporating the npages variable into the overflow checks and ensuring that the calculated end address is strictly validated against the table size limit. System administrators should ensure their kernels are updated to versions containing commit b1af23d836f8 or later, which includes the fix for iommu_tce_check_ioba. Additionally, defense-in-depth measures such as enabling kernel hardening options like KASLR and SMEP can help mitigate exploitation attempts by randomizing memory layout and preventing user-mode code execution in supervisor mode respectively. For organizations utilizing virtualization on PowerPC hardware, it is crucial to monitor for any anomalies related to IOMMU faults or unexpected host crashes that might indicate attempted exploitation of this specific validation bypass.