{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-38594", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:24.028Z", "datePublished": "2025-08-19T17:03:19.689Z", "dateUpdated": "2026-08-05T12:03:16.095Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:03:16.095Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: Fix UAF on sva unbind with pending IOPFs\n\nCommit 17fce9d2336d (\"iommu/vt-d: Put iopf enablement in domain attach\npath\") disables IOPF on device by removing the device from its IOMMU's\nIOPF queue when the last IOPF-capable domain is detached from the device.\nUnfortunately, it did this in a wrong place where there are still pending\nIOPFs. As a result, a use-after-free error is potentially triggered and\neventually a kernel panic with a kernel trace similar to the following:\n\n refcount_t: underflow; use-after-free.\n WARNING: CPU: 3 PID: 313 at lib/refcount.c:28 refcount_warn_saturate+0xd8/0xe0\n Workqueue: iopf_queue/dmar0-iopfq iommu_sva_handle_iopf\n Call Trace:\n \n iopf_free_group+0xe/0x20\n process_one_work+0x197/0x3d0\n worker_thread+0x23a/0x350\n ? rescuer_thread+0x4a0/0x4a0\n kthread+0xf8/0x230\n ? finish_task_switch.isra.0+0x81/0x260\n ? kthreads_online_cpu+0x110/0x110\n ? kthreads_online_cpu+0x110/0x110\n ret_from_fork+0x13b/0x170\n ? kthreads_online_cpu+0x110/0x110\n ret_from_fork_asm+0x11/0x20\n \n ---[ end trace 0000000000000000 ]---\n\nThe intel_pasid_tear_down_entry() function is responsible for blocking\nhardware from generating new page faults and flushing all in-flight\nones. Therefore, moving iopf_for_domain_remove() after this function\nshould resolve this." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable path is entered from a local process closing an SVA-bound accelerator file descriptor (/dev/dsa/wqX.Y) or via iommufd/VFIO ioctls; no network or adjacent-network reachability exists.\nAC:L - The attacker controls both sides of the race — generating pending IOPFs by submitting descriptors against not-present pages, then immediately triggering unbind via close() — and can repeat the loop indefinitely until the workqueue window is hit.\nPR:L - Requires only an unprivileged local process holding an idxd shared-work-queue fd, which is the intended usage model for DSA/IAA SVA (userspace ENQCMD submission); no root or capability is needed once the device node is accessible.\nUI:N - The attacking process performs the bind, fault generation, and unbind entirely on its own; no victim action is involved.\nS:U - The corruption is confined to kernel heap objects within the host kernel's own security authority; no DMA/IOMMU translation isolation or VM boundary is bypassed by the bug itself.\nC:H - The freed iopf_group is reused by the worker, which dereferences attacker-reallocatable pointers (fault_param->dev, attach_handle->domain->mm), giving an arbitrary kernel-memory read primitive and full disclosure potential.\nI:H - A double-freed generic-slab object whose fields drive an indirect call through dev_iommu_ops(dev)->page_response() provides heap-spray-based control-flow hijacking and arbitrary write, enabling privilege escalation.\nA:H - The reported real-world outcome is a refcount underflow WARNING followed by kernel panic from the iopf workqueue; any use-after-free of this kind reliably crashes the system." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/iommu/intel/iommu.c" ], "versions": [ { "version": "17fce9d2336d952b95474248303e5e7d9777f2e0", "lessThan": "c68332b7ee893292bba6e87d31ef2080c066c65d", "status": "affected", "versionType": "git" }, { "version": "17fce9d2336d952b95474248303e5e7d9777f2e0", "lessThan": "f0b9d31c6edd50a6207489cd1bd4ddac814b9cd2", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/iommu/intel/iommu.c" ], "versions": [ { "version": "6.16", "status": "affected" }, { "version": "0", "lessThan": "6.16", "status": "unaffected", "versionType": "semver" }, { "version": "6.16.1", "lessThanOrEqual": "6.16.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.17", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.16.1" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.17" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/c68332b7ee893292bba6e87d31ef2080c066c65d" }, { "url": "https://git.kernel.org/stable/c/f0b9d31c6edd50a6207489cd1bd4ddac814b9cd2" } ], "title": "iommu/vt-d: Fix UAF on sva unbind with pending IOPFs", "x_generator": { "engine": "bippy-1.2.0" } } } }