Linux kernel (drivers/iommu/amd): On AMD hosts, switching a device's IOMMU group between a DMA domain and an identity

CVSS 5.5CVE-2021-47140Kernel, userspace & hypervisorcurated

Impact

On AMD hosts, switching a device's IOMMU group between a DMA domain and an identity (passthrough) domain left the stale dma-iommu operations installed on the device, so the DMA layer then calls IOMMU helpers against a domain that has none. The node oopses on the next allocation - and the switch in question is precisely the identity/DMA transition an operator performs when preparing or reclaiming a card for passthrough.

Who can reach it

Needs host root: unbind the driver, write to /sys/bus/pci/devices/<bdf>/iommu_group/type, rebind. That is node-provisioning automation, not a tenant surface. Affects AMD-Vi hosts; the equivalent VT-d path was already fixed.

What to do

Update to a stable kernel carrying commits f3f2cf46 / d6177a65 - this is old enough that every supported distro kernel has it, so treat it as a floor check rather than an action. Interim: reboot the node after changing iommu_group/type instead of rebinding drivers in place.

References

https://git.kernel.org/stable/c/f3f2cf46291a693eab21adb94171b0128c2a9ec1 https://git.kernel.org/stable/c/d6177a6556f853785867e2ec6d5b7f4906f0d809 https://nvd.nist.gov/vuln/detail/CVE-2021-47140

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.