Linux kernel (drivers/iommu/iommufd): The vfio type1 info structure is not zeroed before being filled and copied out

Impact

The vfio type1 info structure is not zeroed before being filled and copied out, and the copy-in covers fewer bytes than the struct, so padding bytes of kernel stack are handed to the caller. Kernel memory disclosure to a tenant through iommufd's vfio compatibility ioctl.

Who can reach it

A tenant or VMM holding /dev/iommu, or a vfio container backed by iommufd, calling the type1 GET_INFO ioctl through the compat layer. One ioctl, no race, no host root.

What to do

The record lists no fixed release; boot a kernel carrying the stable fix commits below. Interim control: keep /dev/iommu out of tenant containers.

References