Bug 2502513 (CVE-2026-64151)

Summary:	CVE-2026-64151 kernel: iommupt: Check for missing PAGE_SIZE in the pgsize_bitmap
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Linux kernel's IOMMU (Input/Output Memory Management Unit) page table driver. This vulnerability involves a missing check for the system's fundamental memory page size (PAGE_SIZE) within the pgsize_bitmap data structure. While an IOMMU configuration with this missing check would not typically be used with the Direct Memory Access (DMA) API, this design oversight could lead to unexpected system behavior or integrity issues.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-19 17:03:30 UTC

In the Linux kernel, the following vulnerability has been resolved:

iommupt: Check for missing PAGE_SIZE in the pgsize_bitmap

Sashiko pointed out that the driver could drop PAGE_SIZE from the
pgsize_bitmap. That is technically allowed but nothing does it, and
such an iommu_domain would not be used with the DMA API today.

Still, it is against the design and it is trivial to fix up. Lift
the PT_WARN_ON to the if branch and just skip the fast path.

Comment 1 TEJ RATHI 2026-07-20 14:07:38 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026071931-CVE-2026-64151-1bcc@gregkh/T