Executive brief
A vulnerability was identified in the Linux kernel's IOMMU component, which manages how hardware devices interact with system memory. Under specific conditions where a device fails its initial setup, resetting the device could cause the entire system to crash. This issue primarily impacts system stability and availability for local users.
Technical details
A NULL pointer dereference exists in the Linux kernel's IOMMU subsystem within the `pci_dev_reset_iommu_done()` function in `drivers/iommu/iommu.c`. The vulnerability is triggered when `group->domain` is NULL due to a failed default domain allocation during the initial probe. When a PCI reset occurs, `pci_dev_reset_iommu_done()` attempts to re-attach the RID domain by calling `__iommu_attach_device()`, which subsequently dereferences `domain->ops->attach_dev`. If the domain is NULL, this results in a kernel panic. The fix involves checking for a valid `group->domain` before attempting the re-attach operation. This is a local denial-of-service vulnerability.
Affected products
- Linux Linux Kernel 7.0 to 7.0.10, 7.1
Timeline
- 2026-06-26: advisory
- 2026-06-26: patched