Linux kernel (drivers/iommu/intel): Use-after-free of VT-d cache-tag objects. Device-TLB cache tags outlive the IOMMU

Impact

Use-after-free of VT-d cache-tag objects. Device-TLB cache tags outlive the IOMMU domain they belong to, so a later IOTLB flush walks freed kernel memory. The upstream report reproduces it exactly as an operator would hit it - several VFs from different PFs passed through to one userspace process - and the crash arrives via the tenant's own DMA unmap ioctl. Scope-changed: a tenant's ordinary unmap corrupts host kernel state.

Who can reach it

A tenant process or VM holding /dev/vfio/* with one or more ATS-capable VFs assigned. The freed cache tag is reached from vfio_iommu_type1's VFIO_IOMMU_UNMAP_DMA path, i.e. an ioctl the tenant issues itself. Conditional on Intel VT-d with device-TLB/ATS enabled on the assigned functions. No host root required.

What to do

The record lists no fixed release; boot a kernel carrying the stable fix commits below. Interim controls: avoid assigning VFs from multiple different PFs to a single tenant, and disable ATS on assigned functions where the device allows it.

References