Linux kernel (drivers/iommu/iommufd): A tenant supplies an IOVA and user pointer whose alignment math overflows, so

Impact

A tenant supplies an IOVA and user pointer whose alignment math overflows, so iommufd allocates the mapping area over a different IOVA range than the one it validated. A DMA window ends up somewhere the kernel did not intend it - the precondition for a passthrough device reaching memory outside its tenant's assignment.

Who can reach it

Any holder of /dev/iommu - a VMM for a passthrough VM, or a container handed the iommufd node - issuing IOMMU_IOAS_MAP with a crafted iova/user-pointer pair. Found by syzkaller, but the overflow is in the production area-allocation path (iopt_alloc_area_pages), not in test-only code; CONFIG_IOMMUFD_TEST only makes it visible as a WARN. No host root required.

What to do

The record lists no fixed release; boot a kernel carrying the stable fix commits below. Interim control: do not expose /dev/iommu to tenants; mediate DMA mapping through the host VMM rather than handing the fd into the guest's container.

References