Linux kernel (drivers/iommu/intel): VT-d tore the device off the I/O page-fault queue before the hardware had stopped

Impact

VT-d tore the device off the I/O page-fault queue before the hardware had stopped generating faults and before in-flight ones were drained, so the fault worker kept running against freed fault groups. Result is a refcount underflow and use-after-free in kernel context - reachable by a tenant that simply closes an SVA context while its device still has page requests outstanding.

Who can reach it

Local, on Intel hosts with VT-d scalable mode and an SVA/PASID-capable device exposed to tenants (DSA/IAA accelerators, SVM-capable GPUs, PRI-capable NICs). The tenant binds SVA, drives the device to generate page requests against unmapped addresses, then unbinds or exits so the last IOPF-capable domain detaches while faults are still queued. No host root required; needs PRI/IOPF enabled on the device.

What to do

No fixed release is listed in this record; apply the linked stable commits or run a current stable/LTS kernel. Interim: disable PRI/SVA on devices handed to tenants, or stop exposing SVA-capable accelerator device nodes into tenant containers.

References