Linux kernel (drivers/iommu/riscv): The RISC-V IOMMU driver updated device-directory and process-directory entries

Impact

The RISC-V IOMMU driver updated device-directory and process-directory entries without issuing the invalidations the specification requires, so the hardware keeps using cached device and PASID context after the kernel has moved or freed it. A device therefore keeps translating through a context the kernel believes is gone - a stale mapping that survives detach, which is a DMA window into whatever that memory becomes.

Who can reach it

Reached on any domain attach/detach or PASID setup for a device behind a RISC-V IOMMU - a tenant closing or rebinding a passthrough device is enough. Hardware-conditional: this affects RISC-V platforms only and is not reachable on the x86 or Arm nodes that make up essentially all GPU fleets today. Track it only if RISC-V hosts are in the estate.

What to do

Update to a stable kernel carrying commits 3f917d9b / d99d1c13 on RISC-V hosts. No action needed on x86 (VT-d/AMD-Vi) or Arm SMMU nodes.

References