CVE-2026-68324

What it actually does

Out-of-bounds write in kernel memory caused by oversized memset in dmar_latency_disable() that clears beyond the intended single latency_statistic entry when type exceeds zero.

Why it matters to the business

May cause kernel crashes, data corruption, or privilege escalation on Linux systems using Intel IOMMU, leading to downtime or security breaches on servers and embedded devices.

How an attack unfolds

An attacker with local access invokes dmar_latency_disable() with a type value greater than zero, triggering the oversized memset that corrupts adjacent kernel structures and can be leveraged for code execution.

How to fix it

Apply the kernel patch that changes the memset size from sizeof(*lstat) * DMAR_LATENCY_NUM to sizeof(*lstat) to clear only the target entry.

How to confirm the fix worked

Inspect the dmar_latency_disable() implementation in the IOMMU Intel driver source to confirm the memset argument uses only sizeof(*lstat); test with type greater than zero under memory debugging tools.

Typical attack path

1. Obtain local access to a vulnerable Linux system
2. Trigger the IOMMU DMAR latency disable path with elevated type index
3. Exploit resulting memory corruption to escalate privileges or cause denial of service

How to detect it

Review kernel logs and crash dumps for signs of memory corruption or panics near DMAR latency handling; no public exploitation artifacts reported.

What your security team should do

• Prioritize kernel updates on all Intel IOMMU-enabled Linux hosts
• Enable kernel memory protection features such as KASAN during testing
• Monitor for unexplained kernel panics involving DMAR structures