{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "e36ba5ab808ef6237c3148d469c8238674230e2b"
            },
            {
              "fixed": "779480ea79551c31964e74b9aef0e730faa3aa11"
            },
            {
              "fixed": "6c5fc40200cd0a87d66a368eee00df4d1cca946e"
            },
            {
              "fixed": "47443565d10c51366c9382dbc8597cd6c460b8a2"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.15.0"
            },
            {
              "fixed": "6.18.40"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.19.0"
            },
            {
              "fixed": "7.1.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64292.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\niommufd: Move vevent memory allocation outside spinlock\n\nThe veventq memory allocation happens inside the spinlock. Given its depth\nis decided by the user space, this leaves a vulnerability, where userspace\ncan allocate large queues to exhaust atomic memory reserves.\n\nMove the allocation outside the spinlock and use GFP_NOWAIT, which can fail\nfast under memory pressure without dipping into the GFP_ATOMIC reserves or\ndirect-reclaiming from the threaded IRQ handler. On allocation failure,\nqueue the lost_events_header (so userspace learns of the drop) and return\n-ENOMEM so the caller learns of the kernel-side memory pressure.\n\nThis is intentionally distinct from the queue-overflow path, which also\nqueues the lost_events_header but returns 0: a full queue is an expected\nuserspace-pacing condition rather than a kernel error.\n\nA subsequent change will cap the upper bound of the veventq_depth.",
  "id": "CVE-2026-64292",
  "modified": "2026-07-27T03:56:42.059877529Z",
  "published": "2026-07-25T08:49:31.325Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/47443565d10c51366c9382dbc8597cd6c460b8a2"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6c5fc40200cd0a87d66a368eee00df4d1cca946e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/779480ea79551c31964e74b9aef0e730faa3aa11"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64292.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64292"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.8.0",
  "summary": "iommufd: Move vevent memory allocation outside spinlock"
}