Linux kernel (drivers/iommu/iommufd): The iommufd dirty-tracking bitmap computed an index by shifting a 32-bit constant

CVSS 5.0CVE-2025-21724Kernel, userspace & hypervisorcurated

Impact

The iommufd dirty-tracking bitmap computed an index by shifting a 32-bit constant by a user-supplied page shift, so a large shift produces undefined behaviour and a garbage index into the bitmap that tracks which IOVAs a passthrough device has written. Garbage indexing into that structure is the wrong kind of wrong for a mapping-tracking data structure - treat it as untrusted input reaching IOVA bookkeeping.

Who can reach it

A process holding /dev/iommu supplies an out-of-range page shift (upstream cites 63) on the dirty-tracking bitmap path. Plain ioctl input validation on the fd a passthrough tenant already holds; no host root, no device required. Conditional on iommufd being in use on the node. Same input surface as CVE-2025-40293, which turns the same overflow into a divide-by-zero.

What to do

No fixed release is listed in this record; apply the linked stable commits or run a current stable/LTS kernel, and take it together with the CVE-2025-40293 fix since they harden the same path. Interim: keep /dev/iommu out of containers that do not perform passthrough and validate page-size arguments in the VMM layer.

References

https://git.kernel.org/stable/c/44d9c94b7a3f29a3e07c4753603a35e9b28842a3 https://git.kernel.org/stable/c/38ac76fc06bc6826a3e4b12a98efbe98432380a9 https://nvd.nist.gov/vuln/detail/CVE-2025-21724

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.