Linux kernel (drivers/iommu/iommufd): Iommufd accepts a user address plus length that wraps past zero, then asks the mm

Impact

Iommufd accepts a user address plus length that wraps past zero, then asks the mm to pin pages for a range that cannot exist. The DMA-map path proceeds on arithmetic the kernel never validated, which is the class of bug that ends with a mapping describing the wrong physical pages.

Who can reach it

A holder of /dev/iommu calling IOMMU_IOAS_MAP with a user pointer near UINTPTR_MAX so uptr + length overflows. Plain ioctl, no race, no root. Conditional on iommufd being the passthrough path in use.

What to do

The record lists no fixed release; boot a kernel carrying the stable fix commits below. Interim control: do not expose /dev/iommu to tenants.

References