Executive brief
The Linux kernel's iommufd subsystem contained a bug where hardware page table objects were incorrectly added to a linked list twice, corrupting the list structure in certain scenarios. This could lead to kernel memory corruption and system instability when using specific IOMMU attachment operations.
Technical details
The vulnerability is a logic error in the iommufd device attachment code (drivers/iommu/iommufd/device.c). Hardware page table (hwpt) objects are added to the ioas->hwpt_list only during creation, but redundant code was adding them again during attachment, corrupting the linked list in some cases. The issue affects HWPT-specific attachment operations. The vulnerability requires no special privileges or network access—it can be triggered locally by applications using the iommufd interface to perform device attachment with specific struct configurations. The fix removes the redundant list_add_tail call that was a leftover from an earlier code rework.
Affected products
- Linux Linux kernel 5.15 through 6.1 (and potentially earlier versions)
Timeline
- 2023-02-13: disclosed
- 2023-02-15: patched