Executive brief
A vulnerability in the Linux kernel's Intel IOMMU driver could allow a local user to crash the system. The issue occurs when the system attempts to display internal memory management structures through a debugging interface. If exploited, this could lead to a system 'oops' or kernel panic, resulting in a complete service outage for the affected machine.
Technical details
A vulnerability exists in the Intel IOMMU (VT-d) driver within the Linux kernel's debugfs implementation. In legacy mode, the `domain_translation_struct_show` function incorrectly attempts to walk page tables even when the Translation Type (TT) bits indicate the Second Stage Page Table Pointer (SSPTPTR) should be ignored. This results in the use of uninitialized or zeroed pointers, leading to a general protection fault (GPF) and kernel 'oops' when a local user with access to debugfs (typically root or a privileged user) attempts to read the affected debugfs file. The fix introduces a check for valid Translation Types before proceeding with the page table walk. Patches are available in stable kernel branches 6.12.53, 6.17.3, and 6.18+.
Affected products
- Linux Linux Kernel 6.7 to 6.12.52, 6.17.2
Timeline
- 2025-09-18: other: Initial patch authored
- 2025-11-12: advisory: CVE-2025-40155 published