Linux kernel IOMMU DMA: unlocked msi_page_list corruption with two devices in one VFIO container

Impact

On IOMMUs that publish IOMMU_RESV_SW_MSI (ARM SMMU in practice), a VM assigned two devices through the legacy VFIO type1 container shares one merged iommu_domain across both device fds. A prior commit removed the global msi_prepare_lock on the assumption that a domain belongs to exactly one group, which is false for the merged-container case, so two parallel VFIO_DEVICE_SET_IRQS calls can enter iommu_dma_get_msi_page() concurrently and corrupt the shared msi_page_list. This is the code path GPU and NIC passthrough runs through on Arm hosts, so the blast radius is host-side IOMMU state used to map guest MSIs, with the integrity and availability impact NVD scores at 7.8. The fix restores the static lock; the maintainers note contention is expected to be effectively nil.

Who can reach it

Local - a guest or local user able to drive two passed-through devices in one legacy VFIO type1 container (needs access to the VFIO device fds, i.e. an authorized passthrough VM or a local user with /dev/vfio permissions). x86 hosts are not affected: the race requires an IOMMU that reserves a software MSI region, such as ARM SMMU.

What to do

Pick up the stable kernels carrying the three listed commits and reboot the affected hosts; there is no runtime mitigation short of not placing two SW-MSI devices in the same legacy container. On Arm GPU/accelerator hosts this is a drain-and-reboot per node. x86-only fleets can defer. iommufd-based passthrough already avoids the equivalent problem via its own sw_msi_lock.

References

Related entries

• Linux kernel RDMA/siw: use-after-free in siw_accept() when the supplied QP is already in RTSCVE-2026-90292 · Linux kernel RDMA/siw (software iWARP, siw_accept() connection endpoint refcount)High
• Linux kernel RDMA/erdma: QP freed while async-event and CM handlers still use itCVE-2026-90308 · Linux kernel RDMA/erdma (QP lookup refcounting in AE and iWARP CM paths)High
• Linux kernel RDMA/erdma: completion queue freed while an in-flight EQ handler still references itCVE-2026-90309 · Linux kernel RDMA/erdma (CQ refcounting in EQ event handlers)High
• Linux kernel BPF verifier: load-acquire into its own source register yields pointer type confusionCVE-2026-90312 · Linux kernel BPF verifier (check_atomic_load source pointer type validation)High
• Linux kernel BPF verifier: kptrs stay valid after the final spin unlock ends RCU protectionCVE-2026-90317 · Linux kernel BPF verifier (RCU pointer validity after final bpf_spin_unlock)High
• Linux kernel bpf x86: trampoline under-allocates the save area for __int128 argumentsCVE-2026-90358 · Linux kernel BPF x86 JIT (trampoline register save area for 128-bit arguments)High