Executive brief
A vulnerability in the Linux kernel's RISC-V memory management component could cause the system to enter an infinite loop. This occurs when the system attempts to clear certain memory address mappings at the very end of the available address space. If triggered, this could lead to a system hang or denial of service, impacting the availability of the affected machine.
Technical details
A vulnerability exists in the `riscv_iommu_iotlb_inval` function within `drivers/iommu/riscv/iommu.c` of the Linux kernel. The issue stems from an integer overflow when calculating the length of a memory range (`end - start + 1`) or when incrementing the I/O Virtual Address (IOVA) during IOTLB invalidation. Because RISC-V supports sign-extended page tables, a range ending at `ULONG_MAX` causes the loop condition `iova < end` to fail to terminate correctly as `iova` wraps around. This results in a kernel-level infinite loop. The fix involves using `check_add_overflow` and adjusting the comparison logic to safely handle the maximum address space.
Affected products
- Linux Linux Kernel 6.13, 6.18.33, 7.0.10
Timeline
- 2026-06-26: advisory
- 2026-06-26: disclosed