Executive brief
A logic error in the Linux kernel's iommufd (IOMMU file descriptor) subsystem can cause a NULL pointer dereference crash when domain operations are performed. This affects systems using IOMMU hardware pass-through or virtualization features, potentially leading to kernel crashes and denial of service.
Technical details
The vulnerability exists in the iommufd subsystem's batch_unpin function, where an incorrect variable assignment during batch carry operations leads to a NULL pointer dereference. The root cause is that the 'end' variable should be set to 1 when a carry item is pushed to the pfns list, but this was not happening correctly. The flaw occurs during domain destruction (specifically in the iommufd_ioas.mock_domain.access_domain_destroy code path) when unpinning memory pages. An attacker with sufficient privileges to interact with iommufd interfaces can trigger this crash, resulting in a kernel panic. The fix involves correcting the variable assignment in the batch carry logic.
Affected products
- Linux Linux kernel 6.5.0 and potentially earlier versions
Timeline
- 2025-12-24: disclosed