Linux kernel (drivers/iommu/intel): When the PASID is not found on the device list, VT-d runs the teardown anyway and

Impact

When the PASID is not found on the device list, VT-d runs the teardown anyway and decrements a reference count it never took, so the domain's refcount can reach zero while other devices are still attached to it. The IOMMU domain is then freed under live devices - a use-after-free on the translation state of unrelated passthrough devices that share that domain, plus a NULL dereference on the simpler path.

Who can reach it

A tenant detaching or closing a PASID-attached device through /dev/vfio/* plus /dev/iommu drives the teardown; hitting the not-found case takes a detach that races another detach or a domain replacement. Conditional on VT-d scalable mode with PASID in use. The blast radius is other devices sharing the same domain, which is what makes this cross-tenant rather than self-inflicted.

What to do

Update to a stable kernel carrying commits 9022cb9a / cdfe3c9f (the record's fixed-version list predates the fix and is not a usable target). Interim: avoid sharing one IOMMU domain across devices belonging to different tenants, and disable PASID/scalable mode where SVA is not required.

References