Linux kernel (drivers/iommu/iommufd): A user-supplied page shift of 63 overflows the divisor in the iommufd

CVSS 5.5CVE-2025-40293Kernel, userspace & hypervisorcurated

Impact

A user-supplied page shift of 63 overflows the divisor in the iommufd dirty-tracking bitmap math to zero, giving a divide-by-zero in kernel context. A tenant holding /dev/iommu takes down its own host thread and, on a panic_on_oops fleet, the whole node - a noisy-neighbour outage for every other tenant on the box.

Who can reach it

Any process with /dev/iommu open requests a dirty-tracking bitmap read with an absurd page size, so pgshift reaches 63 and BITS_PER_TYPE * pgsize wraps to zero. Pure ioctl input validation on an fd a passthrough tenant already holds; no device or host root required. Conditional on iommufd being in use and dirty tracking being reachable by the caller.

What to do

No fixed release is listed in this record; apply the linked stable commits or run a current stable/LTS kernel. Interim: keep /dev/iommu out of containers that do not perform passthrough, and validate page-size arguments in the VMM layer that proxies dirty tracking.

References

https://git.kernel.org/stable/c/07105e61882ff4a7d58db63cc5f9e90c6c60506c https://git.kernel.org/stable/c/4c8a4f1d34eced168cc0b3a3dfe7b6dcc2090f69 https://nvd.nist.gov/vuln/detail/CVE-2025-40293

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.