Linux kernel (drivers/iommu/intel): On the VT-d PASID detach path, if the PASID being removed is not found the code

CVSS 5.5CVE-2025-21833Kernel, userspace & hypervisorcurated

Impact

On the VT-d PASID detach path, if the PASID being removed is not found the code warned and then used the NULL result anyway, panicking the host. This is the teardown path that revokes a device's access to a tenant address space, so it runs every time a tenant's SVA context or assigned-device PASID goes away - and a panic there is a whole-node outage for every co-tenant.

Who can reach it

Local, on Intel VT-d scalable mode with PASID in use - SVA-capable accelerators or PASID-based device assignment through iommufd. Reached on PASID detach when the PASID is already absent from the domain. Upstream treats this as a should-not-happen state guarded by WARN_ON_ONCE, so a tenant needs to drive the PASID attach/detach path into an inconsistent state first; no host root is required to exercise attach/detach itself.

What to do

No fixed release is listed in this record; apply the linked stable commits or run a current stable/LTS kernel on Intel passthrough nodes. Interim: limit which tenants can create and tear down PASID contexts, and do not expose SVA-capable device nodes into untrusted containers.

References

https://git.kernel.org/stable/c/68ec78beb4a3fb0877cbaaf49758c85410c05977 https://git.kernel.org/stable/c/df96876be3b064aefc493f760e0639765d13ed0d https://nvd.nist.gov/vuln/detail/CVE-2025-21833

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.