CVE-2026-98282powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
EPSS puts the chance of exploitation in the next 30 days at 0.14%, higher than 3% of scored CVEs.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba The commit b1af23d836f8 ("KVM: PPC: iommu: Unify TCE checking") unified IOBA parameter checking across KVM and VFIO into iommu_tce_check_ioba(). While doing so, the passed in argument npages is ignored and constant value '1' is used leaving out a possible overflow as the callers can legitimately be using npages > 1 for H_STUFF_TCE or H_PUT_TCE_INDIRECT cases. Fix this by accounting for 'npages', checking for arithmetic overflow, and verifying that the entire requested range (ioba - offset + npages) does not exceed the table capacity 'size'.
- CVSS
- 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- 0.14% (percentile 3)
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 7, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from b1af23d836f811137d504d14d4cbdd01929dec34 before 98d8dcc4ebd10523507d4478e148809a7771a213; from b1af23d836f811137d504d14d4cbdd01929dec34 before 9fd9c9bbb05417f468a11fb6d145d7ff61f4a868; from b1af23d836f811137d504d14d4cbdd01929dec34 before 3776bf56e06980e8a12c8c0565d9e6ac44965f03; from b1af23d836f811137d504d14d4cbdd01929dec34 before d6a1779129d936bc1fbab80181165da544eab736; from b1af23d836f811137d504d14d4cbdd01929dec34 before d48ceb6e1a6915c7bac4f902554a1047365cdff2; from b1af23d836f811137d504d14d4cbdd01929dec34 before 0543813753ef5cfbd6fa96694f7acf783fa01af7; from b1af23d836f811137d504d14d4cbdd01929dec34 before 314091243159f8e3749bc719bb129f423f72fd86; from b1af23d836f811137d504d14d4cbdd01929dec34 before 0b271f7d7f5ed45bc498a03ce0aa9cfd8402fc71 | CNA record |
References
- https://git.kernel.org/stable/c/98d8dcc4ebd10523507d4478e148809a7771a213
- https://git.kernel.org/stable/c/9fd9c9bbb05417f468a11fb6d145d7ff61f4a868
- https://git.kernel.org/stable/c/3776bf56e06980e8a12c8c0565d9e6ac44965f03
- https://git.kernel.org/stable/c/d6a1779129d936bc1fbab80181165da544eab736
- https://git.kernel.org/stable/c/d48ceb6e1a6915c7bac4f902554a1047365cdff2
- https://git.kernel.org/stable/c/0543813753ef5cfbd6fa96694f7acf783fa01af7
- https://git.kernel.org/stable/c/314091243159f8e3749bc719bb129f423f72fd86
- https://git.kernel.org/stable/c/0b271f7d7f5ed45bc498a03ce0aa9cfd8402fc71
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.