The Linux kernel contains a bound‑check error in the iommufd_veventq_fops_read() function. The code uses sizeof(hdr) (the pointer size) instead of sizeof(*hdr) (the actual struct size). On a 32‑bit system this under‑counts the header by four bytes, allowing the function to copy eight bytes for the header and then the payload into a user‑supplied buffer that is too small, potentially corrupting user memory.

Any Linux kernel that includes the iommufd driver on a 32‑bit architecture is affected. The bug is also a latent issue if the struct grows beyond the pointer size on 64‑bit systems, although current 64‑bit builds are not impacted.

The CVSS score is 7.8 and the EPSS score is less than 1%, indicating low exploitation likelihood at present. The bug is not listed in the CISA KEV catalog. The likely attack vector is local system interaction with the iommufd driver; an attacker must be able to request a read from the driver to trigger the overflow. No explicit remote exploitation path is described in the CVE data.