CVE-2026-68325

What it actually does

The ivrs_acpihid command-line parser writes entries past the end of a fixed four-element early_acpihid_map array when more than four parameters are supplied, because it lacks the capacity check present in sibling IOAPIC and HPET parsers.

Why it matters to the business

Systems using AMD IOMMU that accept untrusted kernel boot parameters face a risk of kernel memory corruption, which can cause crashes, denial of service, or potential privilege escalation during startup.

How an attack unfolds

An attacker who can influence the kernel command line supplies five or more ivrs_acpihid= arguments; at boot the parser reaches the common found label, parses the extra HID/UID values, and writes them past the array boundary without checking capacity.

How to fix it

Apply a kernel update that adds the capacity check before the found label in the ivrs_acpihid parser; rebuild and deploy the hardened kernel across all affected AMD-based systems.

How to confirm the fix worked

Inspect the iommu/amd/init.c source for the bounds test at the common found label; confirm the early_acpihid_map size constant is respected before any write; test boot with exactly four and five ivrs_acpihid parameters and verify the fifth is rejected.

Typical attack path

1. Obtain the ability to set or append kernel command-line parameters
2. Provide five or more ivrs_acpihid entries on the command line
3. Trigger a system boot so the AMD IOMMU early parser executes
4. Cause an out-of-bounds write into the early_acpihid_map structure

How to detect it

Review kernel boot logs and dmesg output for AMD IOMMU initialization messages or warnings about acpihid map capacity; audit historical kernel command lines for repeated ivrs_acpihid parameters; search system configuration repositories for excess entries.

What your security team should do

• Prioritize kernel updates on all AMD IOMMU hosts
• Restrict write access to bootloader configuration files and EFI variables
• Add boot-parameter auditing to the change-management process
• Include the fixed parser logic in any custom or downstream kernel builds