Executive brief
A vulnerability was identified in the Linux kernel's AMD IOMMU driver, which manages how hardware devices interact with system memory. Due to a logic error in how device identifiers are handled, the system might use incorrect or outdated security settings for certain hardware components. This could potentially lead to improper memory access or system instability on computers using AMD processors and specific hardware configurations.
Technical details
In the Linux kernel AMD IOMMU driver, the clone_alias() function incorrectly assumed its first argument was always the original device pointer. However, when called via pci_for_each_dma_alias(), the argument could be an alias device depending on the PCI topology. This caused the driver to compute the wrong source device ID (devid) when looking up and copying Device Table Entries (DTE). Consequently, stale or incorrect DTE entries could be propagated to alias devices, potentially bypassing IOMMU protections or causing memory access issues. The fix ensures the original device pointer is passed through the opaque data argument to correctly compute the devid.
Affected products
- Linux Linux 5.5 to 6.12.91, 6.18.33, 7.0.10
Timeline
- 2026-06-24: disclosed
- 2026-06-24: advisory