Linux kernel (drivers/iommu): When IOMMU registration fails, the core tore down groups and default domains but left

CVSS 5.5CVE-2025-37877Kernel, userspace & hypervisorcurated

Impact

When IOMMU registration fails, the core tore down groups and default domains but left devices still flagged as using iommu-dma. Those devices then keep routing DMA setup through an iommu-dma layer whose domain is gone - a stale binding to a torn-down translation context, and a crash inside iommu-dma. On a node where the IOMMU driver failed to come up, this is the difference between failing closed and devices doing DMA with no functioning translation layer behind them.

Who can reach it

Not tenant-reachable. Triggered on the host during boot or IOMMU driver probe when iommu_device_register() fails - firmware/ACPI-table problems, a broken IOMMU unit, or a driver bug. Matters to an operator because a node in this state should be treated as having no working IOMMU at all, which means no safe device passthrough, rather than as a node that merely logged an error.

What to do

No fixed release is listed in this record; apply the linked stable commits or run a current stable/LTS kernel. Interim: fail nodes closed - if the IOMMU driver did not register cleanly, do not schedule passthrough or device-assigned workloads on that node; check dmesg for IOMMU registration failure as part of node admission.

References

https://git.kernel.org/stable/c/b14d98641312d972bb3f38e82eddf92898522389 https://git.kernel.org/stable/c/104a84276821aed0ed241ce0d82d6c3267e3fcb8 https://nvd.nist.gov/vuln/detail/CVE-2025-37877

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.