Linux kernel (drivers/iommu): Unbinding shared virtual addressing touches the mm's IOMMU state after the domain-free

Impact

Unbinding shared virtual addressing touches the mm's IOMMU state after the domain-free path has already dropped the last reference to that mm, so the kernel reads a freed mm_struct. Any tenant process using SVA on an accelerator can turn an ordinary exit into a use-after-free on host memory, with host code execution as the realistic ceiling.

Who can reach it

A tenant process that bound SVA to a device - GPU SVM through /dev/dri/renderD*, or an accelerator via /dev/vfio/* or uacce - simply unbinds or exits. The upstream report was hit through the Intel Xe GPU driver's VM close path, so a container holding a DRM render node is enough. Conditional on PASID/SVA being enabled on the platform and device; no host root.

What to do

Update to 6.18.20 or later (or your distro's backport of commits 58abeb7b / f5daaa2c). Interim: disable SVA/PASID on tenant nodes (intel_iommu=sm_off on VT-d, or the equivalent driver switch) where the workload does not require shared virtual addressing.

References