Executive brief
The Linux kernel contains a flaw in the AMD IOMMU debugfs interface that handles device ID input. When processing device IDs through a debugfs file, the code improperly accesses memory after a failed search, potentially causing unpredictable behavior or kernel instability. This affects systems with AMD IOMMU hardware running vulnerable kernel versions.
Technical details
The vulnerability is an undefined behavior issue in the `devid_write()` function within `drivers/iommu/amd/debugfs.c`. The `for_each_pci_segment()` loop iterates through PCI segments searching for a match; when the loop completes without finding a matching segment, the `pci_seg` pointer does not remain NULL but instead points to the list head (invalid memory). Subsequent code attempts to access `pci_seg->id`, causing undefined behavior. The fix moves the success-case handling inside the loop and returns `-EINVAL` after the loop if no segment is found. This is a debugfs interface issue (administrative/debugging access only), limiting practical impact but still requiring patching for correctness.
Affected products
- Linux Linux kernel multiple versions (fix backported across stable branches linux-4.x through linux-7.x)
Timeline
- 2026-09-17: disclosed
- 2026-07-22: patched: Upstream fix merged
- 2026-09-14: patched: Backported to stable branches