Linux kernel (drivers/iommu/iommufd): An unmap runs off the end of the pinned page list and drops pin counts on pages

Impact

An unmap runs off the end of the pinned page list and drops pin counts on pages that were never part of the tenant's mapping. Those pages belong to the host kernel or to another tenant, and unpinning them lets memory that is still in use be freed and reallocated. Scope-changed corruption driven from one tenant's ioctl.

Who can reach it

A holder of /dev/iommu issuing IOMMU_IOAS_UNMAP while an access object (an emulated/mediated user of the same IOAS) is present on the range - the ordinary VMM flow. syzkaller-reachable from userspace ioctls; no host root and no hardware precondition beyond iommufd being in use.

What to do

The record lists no fixed release; boot a kernel carrying the stable fix commits below. Interim control: do not hand /dev/iommu to tenants; run passthrough through the host VMM.

References