CVE-2026-98282
High · 8.8CVSS
8.8
EPSS
0.1%
Published
Oct 6, 2026
CISA due date
—
Cloudanix analysis
A bug in address checking for virtual-machine device access on certain server hardware could let a local attacker reach memory they should not be allowed to touch.
- Exploitation
- Local Privilege
- Attacker needs
- Low Privilege
- Complexity
- Low
- Impact
- Full Compromise
- Component
- OS kernel
- Class
- Improper Input Validation
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
The vulnerability allows an overflow in the I/O bus address range validation within iommu_tce_check_ioba() because the npages parameter is ignored and a constant value of 1 is used, permitting callers using npages greater than 1 to potentially access memory ranges beyond the IOMMU table capacity.
Why it matters to the business
Attackers with local access on PowerPC systems using KVM or VFIO could potentially corrupt memory or escalate privileges in virtualized environments, leading to system compromise and disruption of workloads relying on IOMMU-protected devices.
How an attack unfolds
An attacker with local privileges invokes hypercalls such as H_STUFF_TCE or H_PUT_TCE_INDIRECT supplying npages greater than one; the incomplete range check in iommu_tce_check_ioba fails to validate the full requested span, allowing the IOMMU to accept translations that exceed the allocated table size and resulting in unauthorized memory access or corruption.
How to fix it
Apply the upstream kernel commit that restores proper accounting for the npages argument, performs arithmetic overflow checks, and validates the full requested range against the table capacity.
How to confirm the fix worked
Confirm the patched iommu_tce_check_ioba function is present, then exercise H_STUFF_TCE and H_PUT_TCE_INDIRECT paths with npages greater than one while monitoring for range-validation failures.
Typical attack path
- Identify a vulnerable PowerPC Linux kernel running KVM or VFIO
- Obtain local user or process access on the host
- Issue H_STUFF_TCE or H_PUT_TCE_INDIRECT hypercalls with npages greater than one
- Trigger the incomplete overflow check to map or access memory outside the IOMMU table
How to detect it
Inspect kernel logs and hypervisor traces on PowerPC systems for anomalous TCE hypercall patterns or IOMMU table-capacity violations around the time of the vulnerability disclosure.
What your security team should do
- Prioritize kernel updates on all PowerPC systems that use KVM or VFIO
- Limit untrusted local access to hosts performing IOMMU operations
- Review hypervisor configurations to restrict unnecessary TCE hypercall exposure
The record
In the Linux kernel, the following vulnerability has been resolved: powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba The commit b1af23d836f8 ("KVM: PPC: iommu: Unify TCE checking") unified IOBA parameter checking across KVM and VFIO into iommu_tce_check_ioba(). While doing so, the passed in argument npages is ignored and constant value '1' is used leaving out a possible overflow as the callers can legitimately be using npages > 1 for H_STUFF_TCE or H_PUT_TCE_INDIRECT cases. Fix this by accounting for 'npages', checking for arithmetic overflow, and verifying that the entire requested range (ioba - offset + npages) does not exceed the table capacity 'size'.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|