Linux kernel (drivers/iommu/arm/arm-smmu-v3): On Arm hosts a virtual device is mapped to only the first of its Stream

Impact

On Arm hosts a virtual device is mapped to only the first of its Stream IDs, so a guest's invalidation requests never reach the ATC and IOTLB entries belonging to its other streams. Stale device-side translations survive an unmap and the device keeps DMAing into pages the guest already released - an open DMA window into recycled memory. A device with no streams at all makes the kernel read a zero-size pointer out of bounds.

Who can reach it

A tenant VMM using iommufd vDEVICE on an Arm SMMUv3 host (Grace-class AI nodes) creates a vDEVICE for a passthrough device that presents more than one Stream ID, then relies on guest-driven invalidation. Guest-driven and conditional on Arm SMMUv3 with nested translation; not reachable on x86 hosts.

What to do

Update to a stable kernel carrying commits 3808bab5 / 0acbc621. Interim on Grace/Arm nodes: do not enable nested translation (iommufd vDEVICE) for tenant guests, and restrict passthrough to single-Stream-ID devices until patched.

References