Executive brief
The Linux kernel's powerpc IOMMU subsystem incorrectly shares a notifier data structure between PCI and VIO (Virtual I/O) buses. This causes device registration notifications meant for one bus type to be incorrectly delivered to the other, leading to memory corruption when code tries to access fields that don't exist on the wrong device type. An attacker with the ability to register VIO devices could trigger an out-of-bounds memory read, potentially causing a kernel crash or information disclosure.
Technical details
The vulnerability exists in fail_iommu_setup(), which registers a single notifier_block struct to both PCI and VIO buses. Since notifier_block is implemented as a linked list node, both buses end up sharing the same node, causing any subsequent notifiers registered to either bus to be chained together. This results in PCI-specific code (pci_notify() in the VGA arbiter) being invoked on VIO devices, where to_pci_dev() casts a non-PCI device structure, leading to an out-of-bounds read in vga_arbiter_add_pci_device(). The fix creates separate notifier_block structs for PCI and VIO buses, eliminating the shared state. No user interaction is required; the issue is triggered during device enumeration at boot time.
Affected products
- Linux Linux kernel powerpc architecture with IOMMU enabled
Timeline
- 2025-12-24: disclosed