Linux kernel (drivers/iommu/iommufd): The iommufd dirty-tracking bitmap computed an index by shifting a 32-bit constant

Impact

The iommufd dirty-tracking bitmap computed an index by shifting a 32-bit constant by a user-supplied page shift, so a large shift produces undefined behaviour and a garbage index into the bitmap that tracks which IOVAs a passthrough device has written. Garbage indexing into that structure is the wrong kind of wrong for a mapping-tracking data structure - treat it as untrusted input reaching IOVA bookkeeping.

Who can reach it

A process holding /dev/iommu supplies an out-of-range page shift (upstream cites 63) on the dirty-tracking bitmap path. Plain ioctl input validation on the fd a passthrough tenant already holds; no host root, no device required. Conditional on iommufd being in use on the node. Same input surface as CVE-2025-40293, which turns the same overflow into a divide-by-zero.

What to do

No fixed release is listed in this record; apply the linked stable commits or run a current stable/LTS kernel, and take it together with the CVE-2025-40293 fix since they harden the same path. Interim: keep /dev/iommu out of containers that do not perform passthrough and validate page-size arguments in the VMM layer.

References