CVE-2026-64290 - Vulnerability Details - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: iommufd: Break the loop on failure in iommufd_fault_fops_read() On a copy_to_user() failure inside the inner list_for_each_entry, only the inner loop breaks; the outer while re-fetches the just-restored fault group and retries the failing copy_to_user() forever, spinning the reader at 100% CPU with fault->mutex held. Check rc after the inner loop and break the outer while as well.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Linux	Linux Kernel

No data.

No data.

References

Link	Providers
https://git.kernel.org/stable/c/172fc8b19825a0f5884c38f2289188284e2d45ee
https://git.kernel.org/stable/c/5539da127d03c1f6c2e2a49fdfbe331a0ccbdea8
https://git.kernel.org/stable/c/f66c16b175509642ee7082df57c9bf3deaebae1a

History

Sat, 25 Jul 2026 09:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: iommufd: Break the loop on failure in iommufd_fault_fops_read() On a copy_to_user() failure inside the inner list_for_each_entry, only the inner loop breaks; the outer while re-fetches the just-restored fault group and retries the failing copy_to_user() forever, spinning the reader at 100% CPU with fault->mutex held. Check rc after the inner loop and break the outer while as well.
Title		iommufd: Break the loop on failure in iommufd_fault_fops_read()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/172fc8b19825a0f5884c38f2289188284e2d45ee https://git.kernel.org/stable/c/5539da127d03c1f6c2e2a49fdfbe331a0ccbdea8 https://git.kernel.org/stable/c/f66c16b175509642ee7082df57c9bf3deaebae1a

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-25T08:49:30.049Z

Updated: 2026-07-25T08:49:30.049Z

Reserved: 2026-07-19T15:36:31.778Z

Link: CVE-2026-64290

Vulnrichment

No data.

NVD

No data.

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64290", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T15:36:31.778Z", "datePublished": "2026-07-25T08:49:30.049Z", "dateUpdated": "2026-07-25T08:49:30.049Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-07-25T08:49:30.049Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommufd: Break the loop on failure in iommufd_fault_fops_read()\n\nOn a copy_to_user() failure inside the inner list_for_each_entry, only the\ninner loop breaks; the outer while re-fetches the just-restored fault group\nand retries the failing copy_to_user() forever, spinning the reader at 100%\nCPU with fault->mutex held.\n\nCheck rc after the inner loop and break the outer while as well."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/iommu/iommufd/eventq.c"], "versions": [{"version": "07838f7fd529c8a6de44b601d4b7057e6c8d36ed", "lessThan": "5539da127d03c1f6c2e2a49fdfbe331a0ccbdea8", "status": "affected", "versionType": "git"}, {"version": "07838f7fd529c8a6de44b601d4b7057e6c8d36ed", "lessThan": "f66c16b175509642ee7082df57c9bf3deaebae1a", "status": "affected", "versionType": "git"}, {"version": "07838f7fd529c8a6de44b601d4b7057e6c8d36ed", "lessThan": "172fc8b19825a0f5884c38f2289188284e2d45ee", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/iommu/iommufd/eventq.c"], "versions": [{"version": "6.11", "status": "affected"}, {"version": "0", "lessThan": "6.11", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.39", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.4", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.18.39"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "7.1.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "7.2-rc1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/5539da127d03c1f6c2e2a49fdfbe331a0ccbdea8"}, {"url": "https://git.kernel.org/stable/c/f66c16b175509642ee7082df57c9bf3deaebae1a"}, {"url": "https://git.kernel.org/stable/c/172fc8b19825a0f5884c38f2289188284e2d45ee"}], "title": "iommufd: Break the loop on failure in iommufd_fault_fops_read()", "x_generator": {"engine": "bippy-1.2.0"}}}}