Linux kernel (drivers/iommu/iommufd): The same hardware page table gets linked into an address space's page-table list

CVSS 8.8CVE-2023-54043Kernel, userspace & hypervisorcurated

Impact

The same hardware page table gets linked into an address space's page-table list twice, corrupting the list. Iteration over that list is what drives map, unmap and invalidation, so a corrupted list means those operations walk freed or wrong entries - stale IOMMU mappings and host memory corruption, scope-changed per the vendor score.

Who can reach it

A holder of /dev/iommu performing an explicit HWPT attach (attaching a device to a specific hardware page table rather than to an IOAS) - the normal flow a VMM uses for a passthrough device. No host root. The upstream note says the in-tree test suite could not cover this path, so it shipped unexercised.

What to do

The record lists no fixed release; boot a kernel carrying the stable fix commits below. Interim control: keep /dev/iommu out of tenant containers and mediate device attach in the host VMM.

References

https://git.kernel.org/stable/c/c44adefdcf472f946f0632f4e0ddcbf3e00b8516 https://git.kernel.org/stable/c/b4ff830eca097df51af10a9be29e8cc817327919 https://nvd.nist.gov/vuln/detail/CVE-2023-54043

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.