Linux kernel (drivers/iommu/iommufd): Iommufd tears down the page-tracking state behind a dma-buf backed IOAS mapping

Impact

Iommufd tears down the page-tracking state behind a dma-buf backed IOAS mapping while the exporter can still fire invalidation callbacks into it. A tenant can race that teardown into a use-after-free on the structure that decides which host pages its device is allowed to touch, which is a step toward host memory disclosure or a host kernel crash that takes the whole node down.

Who can reach it

A tenant container holding /dev/iommu together with a device fd under /dev/vfio/* sets up an IOAS mapping over a dma-buf (the vfio-pci BAR dma-buf export is the usual source), then races close/detach against the exporter's invalidation callback. No host root and no fabric access are needed - only the passthrough device nodes inside the container, on a kernel new enough to have iommufd dma-buf support.

What to do

Boot a stable kernel carrying the fix commits (0507fced / f2d70dbd); the kernel CNA published no fixed-version list for this one, so track the commits into your distro kernel. Interim: do not expose /dev/iommu directly to tenant containers - keep passthrough behind a VMM the operator controls - and do not enable the vfio-pci dma-buf export path for tenant-held devices.

References