All vulnerabilities
CVE-2026-98282

Linux: powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
8.8High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.14%Chance of exploitation activity in the next 30 days, higher than 2% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in98d8dcc4ebd10523507d4478e148809a7771a213Also 9fd9c9bbb05417f468a11fb6d145d7ff61f4a868, 3776bf56e06980e8a12c8c0565d9e6ac44965f03 and 3 moreCVE List
Published6 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 98d8dcc4ebd10523507d4478e148809a7771a213LinuxCVE List
  • 9fd9c9bbb05417f468a11fb6d145d7ff61f4a868LinuxCVE List
  • 3776bf56e06980e8a12c8c0565d9e6ac44965f03LinuxCVE List
  • 0543813753ef5cfbd6fa96694f7acf783fa01af7LinuxCVE List
  • 314091243159f8e3749bc719bb129f423f72fd86LinuxCVE List
  • 0b271f7d7f5ed45bc498a03ce0aa9cfd8402fc71LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba

The commit b1af23d836f8 ("KVM: PPC: iommu: Unify TCE checking") unified IOBA parameter checking across KVM and VFIO into iommu_tce_check_ioba(). While doing so, the passed in argument npages is ignored and constant value '1' is used leaving out a possible overflow as the callers can legitimately be using npages > 1 for H_STUFF_TCE or H_PUT_TCE_INDIRECT cases.

Fix this by accounting for 'npages', checking for arithmetic overflow, and verifying that the entire requested range (ioba - offset + npages) does not exceed the table capacity 'size'.

Text from CVE List

Affected versions 18

  • Linuxaffected: b1af23d836f811137d504d14d4cbdd01929dec34 before 98d8dcc4ebd10523507d4478e148809a7771a213CVE List
  • Linuxaffected: b1af23d836f811137d504d14d4cbdd01929dec34 before 9fd9c9bbb05417f468a11fb6d145d7ff61f4a868CVE List
  • Linuxaffected: b1af23d836f811137d504d14d4cbdd01929dec34 before 3776bf56e06980e8a12c8c0565d9e6ac44965f03CVE List
  • Linuxaffected: b1af23d836f811137d504d14d4cbdd01929dec34 before d6a1779129d936bc1fbab80181165da544eab736CVE List
  • Linuxaffected: b1af23d836f811137d504d14d4cbdd01929dec34 before d48ceb6e1a6915c7bac4f902554a1047365cdff2CVE List
  • Linuxaffected: b1af23d836f811137d504d14d4cbdd01929dec34 before 0543813753ef5cfbd6fa96694f7acf783fa01af7CVE List
  • Linuxaffected: b1af23d836f811137d504d14d4cbdd01929dec34 before 314091243159f8e3749bc719bb129f423f72fd86CVE List
  • Linuxaffected: b1af23d836f811137d504d14d4cbdd01929dec34 before 0b271f7d7f5ed45bc498a03ce0aa9cfd8402fc71CVE List
  • Linuxaffected: 4.12CVE List
  • Linuxunaffected: all versions before 4.12CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.54 through 6.18.*CVE List
  • Linuxunaffected: 7.2.8 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 8