Linux AMD IOMMU: sign-discarding error check lets nested domains use an unallocated domain ID

Impact

amd_iommu_alloc_domain_nested() stores the int return of amd_iommu_pdom_id_alloc() into a u32 before testing it, so a negative errno becomes a large positive value and the failure check never fires. Under ID-space exhaustion or memory pressure the nested IOMMU domain is set up with a host domain ID that was never allocated, instead of failing with -ENOSPC. Nested IOMMU domains are what back device passthrough to guests, so on an AMD GPU virtualization host this means a passthrough domain sharing or colliding with an ID that belongs elsewhere - the isolation boundary that keeps a tenant's passed-through GPU or NIC from DMAing into another domain. The record scores it with a scope change and high impact across the board, at high attack complexity since it requires driving the allocator to exhaustion.

Who can reach it

Local, low-privileged, on an AMD host using nested IOMMU domains for passthrough. The attacker needs enough control to exhaust the domain ID space or induce allocation failure while a nested domain is created - not a single-syscall trigger.

What to do

Install a kernel carrying the iommu/amd fix and reboot the affected AMD hosts; IOMMU domain setup happens in the boot and device-attach paths, so there is no live fix. Only hosts doing AMD passthrough/nested-domain virtualization need the window.

References

Related entries

• Linux kernel BPF: per-CPU map updates index by logical CPU id, reading past the update bufferCVE-2026-98149 · Linux kernel BPF per-CPU map update paths (array, hash, cgroup storage)High
• Linux kernel RDMA/rxe: ODP write paths accept read-only pages, letting RDMA traffic overwrite the page cacheCVE-2026-98361 · Linux kernel RDMA/rxe (soft-RoCE on-demand paging write path)High
• Linux kernel RDMA/rxe: MR re-registration swaps the PD before validating access flags, freeing a live PDCVE-2026-98366 · Linux kernel RDMA/rxe rxe_rereg_user_mr() (access-flag validation ordering)High
• Linux kernel RDMA/siw: failed QP modify in siw_accept() races QP-to-ERROR transition into a use-after-freeCVE-2026-98367 · Linux kernel RDMA/siw siw_accept() (CEP association cleared outside state_lock)High
• Linux kernel mm/rmap: missing barrier lets a reused anon_vma hang tasks and use-after-free its rootCVE-2026-98507 · Linux kernel mm/rmap (anon_vma publish without memory barrier)High
• Linux kernel rds/ib: stale scatterlist after failed MR registration gives a use-after-free on teardownCVE-2026-98524 · Linux kernel RDS over InfiniBand (rds_ib_map_frmr scatterlist ownership)High