Linux kernel: Overflow validation in PowerPC IOMMU TCE I/O address check
Summary
The Linux kernel's PowerPC IOMMU check for TCE I/O addresses (shared by KVM and VFIO) ignored the number of pages in a request and assumed one. Requests spanning several pages could therefore pass validation even when they exceed the table capacity. A local user or a guest VM on affected PowerPC systems could potentially cause memory corruption or a denial of service through a crash.
Affected
- Linux kernel with the commit b1af23d836f8 (KVM: PPC: iommu: Unify TCE checking) and before the fixes listed below
- Stable branches before 6.1.189, 5.10.271, 5.15.222, 6.6.158, 6.12.112, 6.18.54 and 7.2.8 (per the OSV and CNA ranges)
- Vendor-specific package versions: Unknown.
Fixed in
- Upstream fix commits: 0543813753ef5cfbd6fa96694f7acf783fa01af7, 0b271f7d7f5ed45bc498a03ce0aa9cfd8402fc71, 314091243159f8e3749bc719bb129f423f72fd86, 3776bf56e06980e8a12c8c0565d9e6ac44965f03, 98d8dcc4ebd10523507d4478e148809a7771a213, 9fd9c9bbb05417f468a11fb6d145d7ff61f4a868, d48ceb6e1a6915c7bac4f902554a1047365cdff2, d6a1779129d936bc1fbab80181165da544eab736
- Stable kernels: 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8 and later.
- Distribution-specific fixed versions: Unknown.
Workaround
Unknown. No vendor workaround found; the only remedy in the sources is a patched kernel.
Exploitation
- Not listed in the CISA KEV catalogue.
- No public proof of concept found; this is not exhaustive.
Our recommendation
- Check whether any IBM Power or other PowerPC hosts run Linux with KVM or VFIO.
- Apply the fixed kernel versions through your normal update cycle, prioritising such hosts.
- Verify your distribution's advisory for the fixed package version.
- Restrict local access and guest VM provisioning on affected hosts until patched.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Linux stable commit 0543813753ef git.kernel.org
- Linux stable commit 0b271f7d7f5e git.kernel.org
- Linux stable commit 98d8dcc4ebd1 git.kernel.org
- Linux stable commit d6a1779129d9 git.kernel.org
- OSV entry CVE-2026-98282 osv.dev
- OpenCVE CVE-2026-98282 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 22:23.
Original description (NVD)
In the Linux kernel, the following vulnerability has been resolved: powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba The commit b1af23d836f8 ("KVM: PPC: iommu: Unify TCE checking") unified IOBA parameter checking across KVM and VFIO into iommu_tce_check_ioba(). While doing so, the passed in argument npages is ignored and constant value '1' is used leaving out a possible overflow as the callers can legitimately be using npages > 1 for H_STUFF_TCE or H_PUT_TCE_INDIRECT cases. Fix this by accounting for 'npages', checking for arithmetic overflow, and verifying that the entire requested range (ioba - offset + npages) does not exceed the table capacity 'size'.
NVD references (8)
- https://git.kernel.org/stable/c/0543813753ef5cfbd6fa96694f7acf783fa01af7
- https://git.kernel.org/stable/c/0b271f7d7f5ed45bc498a03ce0aa9cfd8402fc71
- https://git.kernel.org/stable/c/314091243159f8e3749bc719bb129f423f72fd86
- https://git.kernel.org/stable/c/3776bf56e06980e8a12c8c0565d9e6ac44965f03
- https://git.kernel.org/stable/c/98d8dcc4ebd10523507d4478e148809a7771a213
- https://git.kernel.org/stable/c/9fd9c9bbb05417f468a11fb6d145d7ff61f4a868
- https://git.kernel.org/stable/c/d48ceb6e1a6915c7bac4f902554a1047365cdff2
- https://git.kernel.org/stable/c/d6a1779129d936bc1fbab80181165da544eab736
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.