Linux kernel (drivers/iommu/iommufd): The same hardware page table gets linked into an address space's page-table list

Impact

The same hardware page table gets linked into an address space's page-table list twice, corrupting the list. Iteration over that list is what drives map, unmap and invalidation, so a corrupted list means those operations walk freed or wrong entries - stale IOMMU mappings and host memory corruption, scope-changed per the vendor score.

Who can reach it

A holder of /dev/iommu performing an explicit HWPT attach (attaching a device to a specific hardware page table rather than to an IOAS) - the normal flow a VMM uses for a passthrough device. No host root. The upstream note says the in-tree test suite could not cover this path, so it shipped unexercised.

What to do

The record lists no fixed release; boot a kernel carrying the stable fix commits below. Interim control: keep /dev/iommu out of tenant containers and mediate device attach in the host VMM.

References