Executive brief
A vulnerability in the Linux kernel's Intel VT-d driver could cause a non-recoverable system fault. This occurs when the system incorrectly attempts to track 'dirty' memory pages on hardware that does not support synchronized memory access between the processor and the IOMMU component. An exploit could lead to a complete system crash or unauthorized access to sensitive data across security boundaries.
Technical details
The vulnerability exists in the iommu/vt-d component of the Linux kernel. Dirty page tracking requires the IOMMU to atomically update bits in paging structures, which necessitates coherency between the IOMMU and CPU. On hardware where the page walk is incoherent (non-snooped), the Intel VT-d specification dictates that such atomic updates result in a non-recoverable fault. The fix ensures that Shared System Address Data Structures (SSADS) are only marked as supported when both ecap_slads and ecap_smpwc are present, preventing incorrect configuration. This issue was introduced in commit f35f22cc760e and has been patched in various stable branches including 6.12.53 and 6.17.3.
Affected products
- Linux Linux Kernel 6.7 to 6.12.52, 6.17.2
Timeline
- 2025-09-26: patched: Initial fix commit in Linux kernel tree
- 2025-10-28: disclosed: CVE published