Linux kernel (drivers/iommu/intel): A device that does not support ATS never gets inserted into the VT-d device

Impact

A device that does not support ATS never gets inserted into the VT-d device red-black tree, but a later probe failure still runs the removal, which treats the zeroed node as a tree root and corrupts the tree. That tree is what maps an incoming device request back to its device context, so corrupting it means faults and ATS lookups can resolve to the wrong device - and the corruption itself is an out-of-bounds write into kernel memory.

Who can reach it

Requires a probe failure on a device behind VT-d, so the trigger is host-side: driver binding during boot or during passthrough provisioning, on a device without ATS support where a later probe step fails. Not tenant-driven, but the damaged structure is shared by every device on the IOMMU, so the fallout lands on tenant devices.

What to do

Update to a stable kernel carrying commits f5102e0f / d16923a4. Interim: watch for probe failures in the VT-d path during node bring-up and refuse to schedule tenants onto a node that logged one until it is rebooted.

References