{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.4-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read  The bound-check in iommufd_veventq_fops_read() for the normal vEVENT path uses sizeof(hdr) where the surrounding code uses sizeof(*hdr):  \tif (!vevent_for_lost_events_header(cur) \u0026\u0026 \t    sizeof(hdr) + cur-\u003edata_len \u003e count - done) {  hdr is declared as struct iommufd_vevent_header *, so sizeof(hdr) evaluates to the size of the pointer.  Surrounding code uses sizeof(*hdr) consistently:  \tif (done \u003e= count || sizeof(*hdr) \u003e count - done) { \t... \tif (copy_to_user(buf + done, hdr, sizeof(*hdr))) { \t... \tdone += sizeof(*hdr);  struct iommufd_vevent_header is currently 8 bytes (two __u32 fields, flags and sequence), so on 64-bit (sizeof(void *) == 8) the two expressions happen to be equal and the check works as intended.  On 32-bit (sizeof(void *) == 4) the check under-counts the header by 4 bytes: a vEVENT whose data_len causes 8 + cur-\u003edata_len to exceed count - done while 4 + cur-\u003edata_len does not will pass the check, then the loop will copy_to_user 8 bytes of header followed by data_len bytes of payload, writing past the user-supplied buffer.  It is also a latent bug for any future expansion of struct iommufd_vevent_header beyond sizeof(void *) on 64-bit; the check should not depend on the type happening to match the host pointer width.  Use sizeof(*hdr) to match the rest of the function and the actual amount that will be copied.",
  "id": "DEBIAN-CVE-2026-64293",
  "modified": "2026-09-14T16:47:32.646141801Z",
  "published": "2026-07-25T10:17:10.047Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-64293"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-64293"
  ]
}