Executive brief
A bug was identified in the Linux kernel's memory management component (IOMMU) when debug mode is enabled. Under specific error conditions during memory mapping, the system could malfunction because it tried to clean up memory records that were never properly established. This issue primarily affects system stability and diagnostic accuracy during kernel debugging.
Technical details
A latent bug exists in the IOMMU subsystem where the error handling path for mapping failures incorrectly calls iommu_unmap(). This triggers iommu_debug_unmap_begin() and iommu_debug_unmap_end() without a corresponding iommu_debug_map() having been established, leading to unbalanced tracking and potential malfunctions when IOMMU_DEBUG_PAGEALLOC is enabled. The fix involves lifting unmap error handling into iommu_map_nosync() and reordering operations so that trace_map() and iommu_debug_map() record partial mappings before they are immediately unmapped. This ensures that debug tracking remains balanced and provides accurate tracing for partial failures.
Affected products
- Linux Linux 7.0 to 7.0.11
Timeline
- 2026-05-12: other: Patch authored
- 2026-07-19: advisory: CVE published