Linux kernel (drivers/iommu/intel): VT-d walked the PCI DMA-alias list for devices that are not PCI at all while

CVSS 7.8CVE-2024-50101Kernel, userspace & hypervisorcurated

Impact

VT-d walked the PCI DMA-alias list for devices that are not PCI at all while clearing a domain's context entries, operating on the wrong structure. Upstream reports kernel hangs; the isolation consequence is that context-entry teardown on detach does not do what it was meant to, which is how stale translations survive a device being detached from its domain.

Who can reach it

Reached on domain detach and device release for non-PCI (ACPI namespace or platform) devices behind Intel VT-d. This is host-side device lifecycle, not a tenant ioctl - but it runs on the same detach path that is supposed to revoke a departing tenant's DMA access. The vendor scores it 7.8 with full confidentiality, integrity and availability impact.

What to do

Update to 5.15.169, 6.1.114, or 6.6.58 or later. No practical interim control - the path runs whenever a non-PCI device behind VT-d is detached.

References

https://git.kernel.org/stable/c/0bd9a30c22afb5da203386b811ec31429d2caa78 https://git.kernel.org/stable/c/cbfa3a83eba05240ce37839ed48280a05e8e8f6c https://nvd.nist.gov/vuln/detail/CVE-2024-50101

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.