Linux kernel (drivers/iommu/iommufd): The pfn batch end index is left at zero after a carry, so the unpin path walks an

Impact

The pfn batch end index is left at zero after a carry, so the unpin path walks an entry that was never filled and dereferences garbage. This is inside the page-unpinning code that every tenant DMA unmap and every access-domain teardown goes through, so a tenant can crash or corrupt the host from a normal unmap sequence.

Who can reach it

A holder of /dev/iommu doing ordinary map/unmap plus access-domain destroy. Upstream reproduced it from the in-tree test binary hitting the production batch code; the code path is not test-only. No host root, no hardware precondition beyond iommufd being the passthrough path.

What to do

The record lists no fixed release; boot a kernel carrying the stable fix commits below. Interim control: keep /dev/iommu out of tenant containers.

References