Linux kernel (drivers/iommu/intel): On device release VT-d could dereference a NULL domain and, separately, leave the

Impact

On device release VT-d could dereference a NULL domain and, separately, leave the device's scalable-mode context entry uncleared. A context entry that survives device release is a translation the hardware still honours for whatever occupies that bus/device/function next - the stale-mapping shape of a DMA isolation break - and the NULL dereference itself oopses the host.

Who can reach it

Reached on device release/detach: a device leaving its IOMMU group, which on a GPU node happens on driver unbind, VF teardown, or when a tenant's passthrough function is returned to the host. The upstream reproducer is the kdump kernel, where deferred attach means the domain pointer is not yet assigned. Needs host-side device lifecycle events rather than a tenant ioctl - but the residue it leaves is exactly what the next tenant on that BDF would inherit.

What to do

The record lists no fixed release; boot a kernel carrying the stable fix commits below. Interim controls: avoid rapid rebind/reassign cycles of passthrough functions between tenants, and force a full device reset and re-probe before handing a function to a new tenant.

References