CVE-2026-98282
Description
In the Linux kernel, the following vulnerability has been resolved: powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba The commit b1af23d836f8 ("KVM: PPC: iommu: Unify TCE checking") unified IOBA parameter checking across KVM and VFIO into iommu_tce_check_ioba(). While doing so, the passed in argument npages is ignored and constant value '1' is used leaving out a possible overflow as the callers can legitimately be using npages > 1 for H_STUFF_TCE or H_PUT_TCE_INDIRECT cases. Fix this by accounting for 'npages', checking for arithmetic overflow, and verifying that the entire requested range (ioba - offset + npages) does not exceed the table capacity 'size'.
How to fix
- Linux Linux98d8dcc4ebd10523507d4478e148809a7771a213, 9fd9c9bbb05417f468a11fb6d145d7ff61f4a868, 3776bf56e06980e8a12c8c0565d9e6ac44965f03, d6a1779129d936bc1fbab80181165da544eab736, d48ceb6e1a6915c7bac4f902554a1047365cdff2, 0543813753ef5cfbd6fa96694f7acf783fa01af7, 314091243159f8e3749bc719bb129f423f72fd86, 0b271f7d7f5ed45bc498a03ce0aa9cfd8402fc71 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | b1af23d836f811137d504d14d4cbdd01929dec34 ≤ v < 98d8dcc4ebd10523507d4478e148809a7771a213, b1af23d836f811137d504d14d4cbdd01929dec34 ≤ v < 9fd9c9bbb05417f468a11fb6d145d7ff61f4a868, b1af23d836f811137d504d14d4cbdd01929dec34 ≤ v < 3776bf56e06980e8a12c8c0565d9e6ac44965f03, b1af23d836f811137d504d14d4cbdd01929dec34 ≤ v < d6a1779129d936bc1fbab80181165da544eab736, b1af23d836f811137d504d14d4cbdd01929dec34 ≤ v < d48ceb6e1a6915c7bac4f902554a1047365cdff2, b1af23d836f811137d504d14d4cbdd01929dec34 ≤ v < 0543813753ef5cfbd6fa96694f7acf783fa01af7, b1af23d836f811137d504d14d4cbdd01929dec34 ≤ v < 314091243159f8e3749bc719bb129f423f72fd86, b1af23d836f811137d504d14d4cbdd01929dec34 ≤ v < 0b271f7d7f5ed45bc498a03ce0aa9cfd8402fc71, 4.12 | 98d8dcc4ebd10523507d4478e148809a7771a213, 9fd9c9bbb05417f468a11fb6d145d7ff61f4a868, 3776bf56e06980e8a12c8c0565d9e6ac44965f03, d6a1779129d936bc1fbab80181165da544eab736, d48ceb6e1a6915c7bac4f902554a1047365cdff2, 0543813753ef5cfbd6fa96694f7acf783fa01af7, 314091243159f8e3749bc719bb129f423f72fd86, 0b271f7d7f5ed45bc498a03ce0aa9cfd8402fc71 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.