Linux kernel (drivers/iommu/iommufd): The pfn batch carries the wrong page-frame number forward when a mapping spans a

Impact

The pfn batch carries the wrong page-frame number forward when a mapping spans a batch boundary, so page-pin accounting is applied to pages the tenant never mapped. Host page metadata gets corrupted - pages pinned and unpinned out from under whoever actually owns them.

Who can reach it

A tenant or VMM holding /dev/iommu doing an ordinary IOMMU_IOAS_MAP over a region large enough to cross a pfn batch boundary. No race required, no host root, no special hardware beyond iommufd being the passthrough path.

What to do

The record lists no fixed release; boot a kernel carrying the stable fix commits below. Interim control: keep /dev/iommu out of tenant containers.

References