Linux kernel (drivers/iommu/iommufd): The pfn batch end index is left at zero after a carry, so the unpin path walks an

CVSS 8.8CVE-2023-54060Kernel, userspace & hypervisorcurated

Impact

The pfn batch end index is left at zero after a carry, so the unpin path walks an entry that was never filled and dereferences garbage. This is inside the page-unpinning code that every tenant DMA unmap and every access-domain teardown goes through, so a tenant can crash or corrupt the host from a normal unmap sequence.

Who can reach it

A holder of /dev/iommu doing ordinary map/unmap plus access-domain destroy. Upstream reproduced it from the in-tree test binary hitting the production batch code; the code path is not test-only. No host root, no hardware precondition beyond iommufd being the passthrough path.

What to do

The record lists no fixed release; boot a kernel carrying the stable fix commits below. Interim control: keep /dev/iommu out of tenant containers.

References

https://git.kernel.org/stable/c/176f36a376c417b58d19f79edfce20db9317eaa2 https://git.kernel.org/stable/c/b7c822fa6b7701b17e139f1c562fc24135880ed4 https://nvd.nist.gov/vuln/detail/CVE-2023-54060

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.