Executive brief
A vulnerability in the Linux kernel's I/O Memory Management Unit (IOMMU) subsystem can allow a local user to cause a system hang. When the system fails to copy data to a user application, it enters an infinite loop that consumes 100% of the CPU and locks critical system resources. This results in a denial-of-service condition, making the system unresponsive.
Technical details
A logic error in iommufd_fault_fops_read() within drivers/iommu/iommufd/eventq.c causes an infinite loop during a copy_to_user() failure. While the inner list_for_each_entry loop correctly breaks upon a failure, the outer while loop does not check the return code (rc). This causes the kernel to repeatedly re-fetch the same fault group and retry the failing copy operation indefinitely while holding the fault->mutex. An attacker with local access could trigger this condition to cause a denial-of-service (DoS) by spinning the CPU at 100%. The issue has been resolved by adding a check for the return code to break the outer loop.
Affected products
- Linux Linux Kernel 6.11 to 6.18.39, 7.1.4, 7.2-rc1
Timeline
- 2026-07-25: disclosed
- 2026-07-25: advisory