Linux kernel (drivers/iommu/arm/arm-smmu-v3): The SMMUv3 SVA path released the pinned ASID without holding a reference

CVSS 7.8CVE-2022-49426Kernel, userspace & hypervisorcurated

Impact

The SMMUv3 SVA path released the pinned ASID without holding a reference on the mm, so the mm can be freed while the IOMMU still believes it owns that address-space ID. That is a use-after-free on the structure that decides which process's page tables a device is allowed to walk - the classic route from a local unprivileged process to kernel memory corruption, and on Arm hosts to an accelerator pointed at recycled page tables.

Who can reach it

Local, on Arm64 hosts using SMMUv3 SVA (this is the IOMMU on Grace/Grace-Hopper class systems). Any process that can bind an SVA/PASID context through an accelerator character device - a compute accelerator, an SVA-capable NIC queue, or an in-kernel SVA consumer - and then exit while the ASID is still pinned reaches it. No host root required; requires CONFIG_ARM_SMMU_V3_SVA and a device driver that offers SVA binding to userspace.

What to do

No fixed release is listed in this record; apply the linked stable commits or run a current stable/LTS kernel on Arm nodes. Interim: disable SVA for accelerator drivers that expose it to tenants, or do not expose SVA-capable device nodes into tenant containers.

References

https://git.kernel.org/stable/c/fc90f13ea0dcd960e5002d204fa55cec4e0db2fa https://git.kernel.org/stable/c/e3cbbdbff8a4db5d053c53fd71be62ccccdb52b0 https://nvd.nist.gov/vuln/detail/CVE-2022-49426

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.