Linux kernel (drivers/iommu/iommufd): Iommufd accepted any non-zero virtual event queue depth up to U32_MAX, so a

Impact

Iommufd accepted any non-zero virtual event queue depth up to U32_MAX, so a tenant can ask the kernel to allocate an arbitrarily large queue and drive the node into memory exhaustion. That is an OOM kill storm or a hung box for every tenant on the host, from one ioctl.

Who can reach it

A single IOMMUFD_CMD_VEVENTQ_ALLOC from a container holding /dev/iommu, with veventq_depth set enormous. No host root, no hardware prerequisite beyond a vIOMMU/nested setup that exposes virtual event queues.

What to do

Update to a stable kernel carrying commits f565297e / e7b5e556, which caps the depth. Interim: keep /dev/iommu out of tenant containers and set per-container memory cgroup limits that the kernel allocation is charged against where your kernel supports it.

References