Linux kernel (drivers/iommu/intel): Attaching a nested parent domain skips allocating the invalidation batch structure

CVSS 6.5CVE-2024-56668Kernel, userspace & hypervisorcurated

Impact

Attaching a nested parent domain skips allocating the invalidation batch structure, so the first DMA map into that domain dereferences NULL inside the cache-flush path and oopses the host. The same allocation is done without a lock, so it can also be raced and leaked. The crash arrives from a guest VMM's ordinary map operation.

Who can reach it

A VMM holding /dev/iommu that has created a nested parent domain (vIOMMU / nested translation for a passthrough device) and then calls IOMMU_IOAS_MAP. The upstream trace is qemu-system-x86 on Intel VT-d. No host root. Conditional on nested translation being enabled - plain single-level passthrough does not take this path.

What to do

The record lists no fixed release; boot a kernel carrying the stable fix commits below. Interim control: do not expose nested translation / vIOMMU to tenant VMs on unpatched VT-d hosts.

References

https://git.kernel.org/stable/c/ffd774c34774fd4cc0e9cf2976595623a6c3a077 https://git.kernel.org/stable/c/74536f91962d5f6af0a42414773ce61e653c10ee https://nvd.nist.gov/vuln/detail/CVE-2024-56668

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.