Overview
About vulnerability
In the Linux kernel, the following vulnerability has been resolved:
iommu/vt-d: Avoid NULL pointer dereference or refcount corruption
Commit 60f030f7418d (“iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE”) fixed a NULL pointer dereference in an unlikely situation partly.
If dev_pasid is not found in the dev_pasids list, it remains NULL. However, the teardown operations are executed unconditionally, this lead to a NULL pointer dereference or refcount corruption.
If the domain was never attached to this IOMMU, info will be NULL, which would cause an immediate dereference when checking –info->refcnt.
Even if info is not NULL, decrementing the refcount without having removed a valid PASID might unbalance the count. This could lead to premature dropping of the refcount to 0, potentially causing a use-after-free for the remaining active devices sharing the domain.
Fix it by returning early if dev_pasid is NULL, before executing the teardown operations.
Issue found by AI review and suggested by Kevin Tian. https://sashiko.dev/#/patchset/20260421031347.1408890-1-zhenzhong.duan%40intel.com
Details
- Affected product:
- AlmaLinux 9.2 ESU , TuxCare 9.6 ESU
- Affected packages:
- kernel @ 5.14.0 (+1 more)
Fixes
KernelCare state
Live-patch status from KernelCare for each operating system.
| Operating system | Status | Covered kernels |
|---|---|---|
| AlmaLinux 10 | In Rollout |
55 kernels
|
| AlmaLinux 9 | Released |
101 kernels
|
| Oracle Linux 10 | In Rollout |
40 kernels
|
| Oracle Linux 9 | Released |
94 kernels
|
| RHEL 10 | In Rollout |
54 kernels
|
| RHEL 9 | Released |
99 kernels
|
| Rocky Linux 10 | In Rollout |
37 kernels
|
| Rocky Linux 9 | Released |
77 kernels
|