Executive brief
The Linux kernel's iommufd subsystem contains a calculation error in page unmapping operations that corrupts memory pages that should not have been modified. An attacker with local access could trigger this flaw to corrupt kernel memory, potentially leading to system instability or privilege escalation. The vulnerability affects systems using the IOMMU functionality for memory management.
Technical details
The iommufd subsystem contains a logic error in the batch_last_index calculation during page unpinning operations. The vulnerability occurs when an access is present: the function incorrectly calculates which pages to unmap, causing it to overrun the boundaries of the mapped page range and corrupt pages that were never actually mapped. This is triggered via the __iopt_area_unfill_domain function and manifests as a WARNING in the kernel logs when the pinned page count sanity check fails. The flaw can be exploited locally via ioctl calls (iommufd_fops_ioctl) without requiring special privileges beyond local system access. A patch correcting the calculation to use 'start_index' is available.
Affected products
- Linux Linux kernel 6.3.0-rc2 and earlier versions with iommufd
Timeline
- 2025-10-07: disclosed
- patched: Fix applied to use start_index instead of incorrect batch_last_index calculation