Linux kernel AMD IOMMU: one-byte stack buffer overflow parsing an oversized IVRS cmdline option

Impact

The AMD IOMMU driver writes one byte past the end of the on-stack "acpiid" buffer when the IVRS ACPI-HID command line argument is at maximum length. On a GPU node the AMD IOMMU is what enforces DMA isolation for passthrough and for accelerator devices, so bugs in this driver get attention - but this one is reached only from the kernel command line, which is parsed at boot and which the upstream commit itself treats as trusted. There is no tenant-reachable path: a workload in a container or VM cannot influence this string. Practical risk is limited to boot configurations that already have an over-long IVRS option, where the stray write lands on the boot CPU stack.

Who can reach it

Boot-time only. Requires the ability to set the kernel command line (bootloader, UEFI boot entry, or host provisioning), which already implies control of the node. Not reachable by a tenant, a container, or an unprivileged local user.

What to do

Pick up the stable kernel containing the IVRS parsing fix on the usual cadence - this does not justify an out-of-band window. Because it is a kernel change, nodes need a reboot (drain the GPU workloads first). Interim mitigation is simply not passing an over-long ivrs_acpihid option on the command line.

References

Related entries

• Linux kernel (drivers/gpu/drm/xe): Xe frees data that its exported dma-fences still point at - notably the timelineCVE-2025-38703 · Linux kernel (drivers/gpu/drm/xe)High
• Linux kernel nfsd: unchecked client reference in SETCLIENTID_CONFIRM leads to use-after-freeCVE-2025-38724 · Linux kernel nfsd (nfsd4_setclientid_confirm client reference handling)High
• Linux kernel io_uring/net (ring-provided buffers pinned across partial retries): Ring-provided buffers are only validCVE-2025-38730 · Linux kernel io_uring/net (ring-provided buffers pinned across partial retries)High
• Linux kernel (drivers/gpu/drm/xe): A tenant that submits a deliberately malformed array bind to the Xe VM_BIND ioctlCVE-2025-38731 · Linux kernel (drivers/gpu/drm/xe)High
• Linux NFS client: missing minimum-length check when decoding a filehandle lets a crafted handle read out of boundsCVE-2025-39730 · Linux kernel NFS client (nfs_fh_to_dentry filehandle decoding)High
• Linux kernel (drivers/gpu/drm/xe): On the migration error path the previous fence is released before the code waits onCVE-2025-39740 · Linux kernel (drivers/gpu/drm/xe)High