Linux kernel (drivers/iommu): This is the substantive fix for stale IOMMU translations of the kernel address space

CVSS 8.8CVE-2025-71202Kernel, userspace & hypervisorcurated

Impact

This is the substantive fix for stale IOMMU translations of the kernel address space under SVA. Without it the IOMMU keeps cached paging-cache entries for kernel page-table pages that have already been freed and handed out for other use, so a device can DMA through a translation that now points at attacker-placed data - arbitrary physical memory access and privilege escalation from a device a tenant drives. The kernel CNA scored it scope-changed, which is the right read: the blast radius is the host, not the tenant.

Who can reach it

Local unprivileged, on x86 hosts with IOMMU SVA and an SVA/PASID-capable device the tenant can bind (Intel DSA/IAA, SVM-capable GPUs, PRI-capable NICs). The attacker recycles kernel page-table pages through ordinary means - the series calls out vfree() as the common, unprivileged trigger - while an SVA-bound device still has the stale entry cached, then grooms the reallocated page. Requires CONFIG_IOMMU_SVA and a driver exposing SVA binding to userspace.

What to do

No fixed release is listed in this record; take the whole series from the linked stable commits (this plus CVE-2025-71089) or run a current stable/LTS kernel that carries it. Interim: disable SVA/PASID on tenant-facing devices and keep SVA-capable accelerator nodes out of untrusted containers - the upstream series itself disables x86 SVA outright until this invalidation path exists.

References

https://git.kernel.org/stable/c/9f0a7ab700f8620e433b05c57fbd26c92ea186d9 https://git.kernel.org/stable/c/e37d5a2d60a338c5917c45296bac65da1382eda5 https://nvd.nist.gov/vuln/detail/CVE-2025-71202

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.