Linux kernel (drivers/iommu): This is the substantive fix for stale IOMMU translations of the kernel address space

Impact

This is the substantive fix for stale IOMMU translations of the kernel address space under SVA. Without it the IOMMU keeps cached paging-cache entries for kernel page-table pages that have already been freed and handed out for other use, so a device can DMA through a translation that now points at attacker-placed data - arbitrary physical memory access and privilege escalation from a device a tenant drives. The kernel CNA scored it scope-changed, which is the right read: the blast radius is the host, not the tenant.

Who can reach it

Local unprivileged, on x86 hosts with IOMMU SVA and an SVA/PASID-capable device the tenant can bind (Intel DSA/IAA, SVM-capable GPUs, PRI-capable NICs). The attacker recycles kernel page-table pages through ordinary means - the series calls out vfree() as the common, unprivileged trigger - while an SVA-bound device still has the stale entry cached, then grooms the reallocated page. Requires CONFIG_IOMMU_SVA and a driver exposing SVA binding to userspace.

What to do

No fixed release is listed in this record; take the whole series from the linked stable commits (this plus CVE-2025-71089) or run a current stable/LTS kernel that carries it. Interim: disable SVA/PASID on tenant-facing devices and keep SVA-capable accelerator nodes out of untrusted containers - the upstream series itself disables x86 SVA outright until this invalidation path exists.

References