A memory corruption flaw in the Linux kernel iommufd subsystem may allow a local attacker with low privileges to trigger an out-of-bounds write, potentially leading to privilege escalation or system instability.

The vulnerability stems from an incorrect use of sizeof() on a pointer instead of the structure in the iommufd_veventq_fops_read function. On 32-bit systems, this results in an incorrect buffer boundary check, allowing the kernel to write data beyond the user-supplied buffer during vEVENT processing. An attacker requires local access and low privileges to interact with the iommufd interface to trigger this condition.

The ability to perform an out-of-bounds write within the kernel memory space poses a significant risk to system integrity and confidentiality. While the CVSS score of 7.8 (High) reflects the requirement for local access, successful exploitation could allow an attacker to escalate privileges to the root level or crash the operating system, resulting in unauthorized data access or denial of service for critical infrastructure.

Immediate Action: Apply the vendor-supplied kernel updates to version 6.18.39, 7.1.4, or later versions where this memory safety issue has been resolved.

Proactive Monitoring: Monitor system logs for kernel-related faults or unexpected segmentation violations that may indicate an exploitation attempt targeting the iommufd subsystem.

Compensating Controls: Restrict access to the iommufd interface by managing user permissions and employing kernel hardening features such as Address Space Layout Randomization (ASLR) and stack canaries, which may complicate exploitation.

Public Exploit Available: No (exploit_available: false)

This vulnerability represents a serious memory safety risk within the Linux kernel. Given the potential for local privilege escalation, administrators should prioritize patching affected kernel versions as part of their standard maintenance cycle. Ensure that all systems running 32-bit Linux kernels are updated to the specified patched versions to eliminate the risk of out-of-bounds memory writes.