Linux kernel (drivers/iommu/iommufd): Iommufd accepts a user address plus length that wraps past zero, then asks the mm

Impact

Iommufd accepts a user address plus length that wraps past zero, then asks the mm to pin pages for a range that cannot exist. The DMA-map path proceeds on arithmetic the kernel never validated, which is the class of bug that ends with a mapping describing the wrong physical pages.

Who can reach it

A holder of /dev/iommu calling IOMMU_IOAS_MAP with a user pointer near UINTPTR_MAX so uptr + length overflows. Plain ioctl, no race, no root. Conditional on iommufd being the passthrough path in use.

What to do

The record lists no fixed release; boot a kernel carrying the stable fix commits below. Interim control: do not expose /dev/iommu to tenants.

References

Related entries

• Linux kernel (drivers/iommu/iommufd): The cache-invalidation ioctl calls a driver operation that may not exist, jumpingCVE-2024-46824 · Linux kernel (drivers/iommu/iommufd)Medium
• Linux kernel (drivers/iommu/iommufd): A tenant using nested translation can ask iommufd to process a cache-invalidationCVE-2026-64289 · Linux kernel (drivers/iommu/iommufd)Medium
• Linux kernel (drivers/iommu/iommufd): Iommufd accepted any non-zero virtual event queue depth up to U32_MAX, so aCVE-2026-64291 · Linux kernel (drivers/iommu/iommufd)Medium
• Linux kernel (drivers/iommu/iommufd): A failed copy_to_user while draining the iommufd fault queue restarts the sameCVE-2026-64290 · Linux kernel (drivers/iommu/iommufd)Medium
• Linux kernel (drivers/iommu/iommufd): A user-supplied page shift of 63 overflows the divisor in the iommufdCVE-2025-40293 · Linux kernel (drivers/iommu/iommufd)Medium
• Linux kernel (drivers/iommu/iommufd): The vfio type1 info structure is not zeroed before being filled and copied outCVE-2023-54034 · Linux kernel (drivers/iommu/iommufd)Medium