Linux kernel (drivers/iommu/iommufd): Splitting a mapping area - which is what a partial unmap does - leaves the

Impact

Splitting a mapping area - which is what a partial unmap does - leaves the domains interval tree pointing at the old node. Upstream states the outcome plainly as a use-after-free. That tree is what maps IOVA ranges to the IOMMU domains they are programmed into, so corrupting it also means invalidation and teardown target the wrong ranges, leaving live DMA windows behind.

Who can reach it

A holder of /dev/iommu issuing an unmap that falls inside an existing mapping on an IOAS with a domain attached - completely routine VMM behaviour, not a crafted edge case. No host root, no special hardware beyond iommufd being in use.

What to do

The record lists no fixed release; boot a kernel carrying the stable fix commits below. Interim control: do not expose /dev/iommu to tenants.

References