Linux kernel IOMMU core: unbalanced unmap accounting on the map error path with iommu_debug on

Impact

When a mapping fails partway through, the error path called iommu_unmap() - and therefore the iommu_debug unmap accounting - for a mapping the debug layer never recorded, leaving the tracking state unbalanced. NVD scores it 7.8 with a changed scope (S:C), which is consistent with a fault in the layer that enforces DMA isolation for VFIO GPU and NIC passthrough. That is the layer a GPU cloud depends on to keep a passed-through H100 or ConnectX from reading another tenant's memory, so a defect there deserves attention even when the trigger is narrow. The important qualifier: this only bites on kernels built with IOMMU debug tracking enabled, which is not a stock distro server configuration - check your kernel config before scheduling anything.

Who can reach it

Local user able to drive IOMMU map operations that can fail - a VFIO passthrough guest or a process holding a device FD - on a kernel built with iommu_debug enabled. No remote path.

What to do

First establish whether your kernels enable IOMMU debug tracking at all; if not, you are not exposed and no window is needed. If they do, take the stable fix and reboot the affected nodes, or rebuild without the debug option. On passthrough hosts a reboot means evacuating the guests holding the devices.

References