In the Linux kernel, the following vulnerability has been resolved:
iommu/vt-d: Remove cache tags before disabling ATS
The current implementation removes cache tags after disabling ATS, leading to potential memory leaks and kernel crashes. Specifically, CACHE_TAG_DEVTLB type cache tags may still remain in the list even after the domain is freed, causing a use-after-free condition.
This issue really shows up when multiple VFs from different PFs passed through to a single user-space process via vfio-pci. In such cases, the kernel may crash with kernel messages like:
BUG: kernel NULL pointer dereference, address: 0000000000000014 PGD 19036a067 P4D 1940a3067 PUD 136c9b067 PMD 0 Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 74 UID: 0 PID: 3183 Comm: testCli Not tainted 6.11.9 #2 RIP: 0010:cache_tag_flush_range+0x9b/0x250 Call Trace: <TASK> ? __die+0x1f/0x60 ? page_fault_oops+0x163/0x590 ? exc_page_fault+0x72/0x190 ? asm_exc_page_fault+0x22/0x30 ? cache_tag_flush_range+0x9b/0x250 ? cache_tag_flush_range+0x5d/0x250 intel_iommu_tlb_sync+0x29/0x40 intel_iommu_unmap_pages+0xfe/0x160 __iommu_unmap+0xd8/0x1a0 vfio_unmap_unpin+0x182/0x340 [vfio_iommu_type1] vfio_remove_dma+0x2a/0xb0 [vfio_iommu_type1] vfio_iommu_type1_ioctl+0xafa/0x18e0 [vfio_iommu_type1]
Move cache_tag_unassign_domain() before iommu_disable_pci_caps() to fix it.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 27, 2026 | Jul 27, 2026 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Dec 27, 2024 |
| Ubuntu | — | Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.11.0-1012-azure-fdeUpgrade linux-image-raspiUpgrade linux-image-lowlatencyUpgrade linux-image-6.11.0-1011-gcp-64kUpgrade linux-image-6.11.0-21-genericUpgrade linux-image-6.11.0-1007-realtimeUpgrade linux-image-azureUpgrade linux-image-6.11.0-1013-oracleUpgrade linux-image-6.11.0-1011-gcpUpgrade linux-image-6.11.0-1011-lowlatencyUpgrade linux-image-realtime-hwe-24.04Upgrade linux-image-6.11.0-1011-awsUpgrade linux-image-azure-fdeUpgrade linux-image-6.11.0-1012-azureUpgrade linux-image-gcp-64kUpgrade linux-image-awsUpgrade linux-image-6.11.0-1017-oemUpgrade linux-image-6.11.0-1013-oracle-64kUpgrade linux-image-6.11.0-21-generic-64kUpgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-oracle-64kUpgrade linux-image-genericUpgrade linux-image-oem-24.04Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-oracleUpgrade linux-image-generic-64kUpgrade linux-image-realtimeUpgrade linux-image-6.11.0-1011-lowlatency-64kUpgrade linux-image-oem-24.04aUpgrade linux-image-virtualUpgrade linux-image-gcpUpgrade linux-image-oem-24.04bUpgrade linux-image-lowlatency-64kUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.11.0-1010-raspi | Mar 28, 2025 | Dec 27, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub