CVE-2025-38688iommufd: Prevent ALIGN() overflow
Updated under an hour ago ()
Does this affect you?
It affects Linux and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: iommufd: Prevent ALIGN() overflow When allocating IOVA the candidate range gets aligned to the target alignment. If the range is close to ULONG_MAX then the ALIGN() can wrap resulting in a corrupted iova. Open code the ALIGN() using get_add_overflow() to prevent this. This simplifies the checks as we don't need to check for length earlier either. Consolidate the two copies of this code under a single helper. This bug would allow userspace to create a mapping that overlaps with some other mapping or a reserved range.
- CVSS
- 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Modified
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 15, 2026
Affected products
Linux Linux linux:linux (from the name) | from 51fe6141f0f64ae0bbc096a41a07572273e8c0ef before d19b817540c0abe84854a64ee9ee34cecc3bbeef; from 51fe6141f0f64ae0bbc096a41a07572273e8c0ef before ebb6021560b94649bec6b8faba6fe0dca2218e81; from 51fe6141f0f64ae0bbc096a41a07572273e8c0ef before e42a046bb41dcdde4f766a17d8211842007ed537; from 51fe6141f0f64ae0bbc096a41a07572273e8c0ef before 79fad1917802c28de51a479318a056a6fbe3e2f2; from 51fe6141f0f64ae0bbc096a41a07572273e8c0ef before b42497e3c0e74db061eafad41c0cd7243c46436b | CNA record |
linux linux_kernel linux:linux_kernel | from 6.2 before 6.6.103; from 6.7 before 6.12.43; from 6.13 before 6.15.11; from 6.16 before 6.16.2 | NVD |
References
- https://git.kernel.org/stable/c/d19b817540c0abe84854a64ee9ee34cecc3bbeefpatch
- https://git.kernel.org/stable/c/ebb6021560b94649bec6b8faba6fe0dca2218e81patch
- https://git.kernel.org/stable/c/e42a046bb41dcdde4f766a17d8211842007ed537patch
- https://git.kernel.org/stable/c/79fad1917802c28de51a479318a056a6fbe3e2f2patch
- https://git.kernel.org/stable/c/b42497e3c0e74db061eafad41c0cd7243c46436bpatch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.