Linux kernel (drivers/iommu): A dropped return statement made the IOMMU fault handler process a partial PRI

CVSS 8.8CVE-2024-44994Kernel, userspace & hypervisorcurated

Impact

A dropped return statement made the IOMMU fault handler process a partial PRI page-request group as if it were complete, instead of collecting it and waiting. The device decides when a group is partial, so a tenant driving a PRI-capable passthrough device can emit the right sequence of page requests and crash the host kernel from inside its own VM or container.

Who can reach it

The fault is generated by the device, and in a passthrough cluster the device is under tenant control. A tenant with an ATS/PRI-capable assigned device (SVM-capable GPU, PRI-capable NIC, DSA/IAA accelerator) issues page requests marked as part of a multi-request group; the host handler mishandles the partial group and eventually crashes. No host root, no fabric access needed - just the assigned device. Conditional on PRI/IOPF being enabled for devices handed to tenants.

What to do

No fixed release is listed in this record; apply the linked stable commits or run a current stable/LTS kernel. Interim: disable PRI/ATS on tenant-assigned devices where the workload does not require demand paging, which removes the fault-reporting path entirely.

References

https://git.kernel.org/stable/c/cc6bc2ab1663ec9353636416af22452b078510e9 https://git.kernel.org/stable/c/fca5b78511e98bdff2cdd55c172b23200a7b3404 https://nvd.nist.gov/vuln/detail/CVE-2024-44994

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.