Linux kernel (drivers/iommu/arm/arm-smmu-v3): The SMMUv3 SVA path released the pinned ASID without holding a reference

Impact

The SMMUv3 SVA path released the pinned ASID without holding a reference on the mm, so the mm can be freed while the IOMMU still believes it owns that address-space ID. That is a use-after-free on the structure that decides which process's page tables a device is allowed to walk - the classic route from a local unprivileged process to kernel memory corruption, and on Arm hosts to an accelerator pointed at recycled page tables.

Who can reach it

Local, on Arm64 hosts using SMMUv3 SVA (this is the IOMMU on Grace/Grace-Hopper class systems). Any process that can bind an SVA/PASID context through an accelerator character device - a compute accelerator, an SVA-capable NIC queue, or an in-kernel SVA consumer - and then exit while the ASID is still pinned reaches it. No host root required; requires CONFIG_ARM_SMMU_V3_SVA and a device driver that offers SVA binding to userspace.

What to do

No fixed release is listed in this record; apply the linked stable commits or run a current stable/LTS kernel on Arm nodes. Interim: disable SVA for accelerator drivers that expose it to tenants, or do not expose SVA-capable device nodes into tenant containers.

References