Integer overflow in Linux kernel - CVE-2026-98282
Published: October 7, 2026
Vulnerability identifier: #VU153736
CSH Severity: Low
CVSS v4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-98282
CWE-ID: CWE-190
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to bypass I/O bus address range validation.
The vulnerability exists due to incomplete integer overflow and range validation in iommu_tce_check_ioba() in the PowerPC IOMMU code when validating multi-page requests for H_STUFF_TCE or H_PUT_TCE_INDIRECT. A local user can supply a multi-page range that causes arithmetic overflow or exceeds the TCE table capacity to bypass I/O bus address range validation.
The affected validation function is shared by KVM and VFIO.
Affected software
Linux kernel
Debian Linux
linux (Debian package)
Debian Linux
linux (Debian package)
How to mitigate CVE-2026-98282
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
linux (Debian package) - update to 6.12.113-1
linux (Debian package) - update to 6.12.113-1
External References
- https://git.kernel.org/stable/c/0543813753ef5cfbd6fa96694f7acf783fa01af7
- https://git.kernel.org/stable/c/0b271f7d7f5ed45bc498a03ce0aa9cfd8402fc71
- https://git.kernel.org/stable/c/314091243159f8e3749bc719bb129f423f72fd86
- https://git.kernel.org/stable/c/3776bf56e06980e8a12c8c0565d9e6ac44965f03
- https://git.kernel.org/stable/c/98d8dcc4ebd10523507d4478e148809a7771a213
- https://git.kernel.org/stable/c/9fd9c9bbb05417f468a11fb6d145d7ff61f4a868
- https://git.kernel.org/stable/c/d48ceb6e1a6915c7bac4f902554a1047365cdff2
- https://git.kernel.org/stable/c/d6a1779129d936bc1fbab80181165da544eab736