In the Linux kernel, the following vulnerability has been resolved:
powerpc/pseries/iommu: Don't unset window if it was never set
On pSeries, when user attempts to use the same vfio container used by different iommu group, the spapr_tce_set_window() returns -EPERM and the subsequent cleanup leads to the below crash.
Kernel attempted to read user page (308) - exploit attempt? BUG: Kernel NULL pointer dereference on read at 0x00000308 Faulting instruction address: 0xc0000000001ce358 Oops: Kernel access of bad area, sig: 11 [#1] NIP: c0000000001ce358 LR: c0000000001ce05c CTR: c00000000005add0 <snip> NIP [c0000000001ce358] spapr_tce_unset_window+0x3b8/0x510 LR [c0000000001ce05c] spapr_tce_unset_window+0xbc/0x510 Call Trace: spapr_tce_unset_window+0xbc/0x510 (unreliable) tce_iommu_attach_group+0x24c/0x340 [vfio_iommu_spapr_tce] vfio_container_attach_group+0xec/0x240 [vfio] vfio_group_fops_unl_ioctl+0x548/0xb00 [vfio] sys_ioctl+0x754/0x1580 system_call_exception+0x13c/0x330 system_call_vectored_common+0x15c/0x2ec <snip> --- interrupt: 3000
Fix this by having null check for the tbl passed to the spapr_tce_unset_window().
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Feb 27, 2025 |
| Suse | — | Upgrade kernel-64kbUpgrade kernel-zfcpdumpUpgrade reiserfs-kmp-defaultUpgrade kernel-sourceUpgrade kernel-develUpgrade kernel-kvmsmallUpgrade kernel-default-livepatchUpgrade kernel-source-azureUpgrade kernel-obs-qaUpgrade kernel-docs-htmlUpgrade kernel-64kb-develUpgrade kernel-macrosUpgrade kernel-default-develUpgrade kernel-default-extraUpgrade kernel-symsUpgrade kernel-devel-azureUpgrade kernel-kvmsmall-develUpgrade kernel-azure-extraUpgrade kernel-64kb-extraUpgrade kernel-azure-vdsoUpgrade kernel-azure-develUpgrade kernel-syms-azureUpgrade kernel-docsUpgrade kernel-obs-buildUpgrade kernel-source-vanillaUpgrade kernel-default-baseUpgrade kernel-defaultUpgrade kernel-kvmsmall-vdsoUpgrade kernel-default-vdsoUpgrade kernel-azure | Dec 5, 2025 | Jul 8, 2025 |
| Ubuntu | — | Upgrade linux-image-raspiUpgrade linux-image-azure-fdeUpgrade linux-image-generic-64kUpgrade linux-image-realtimeUpgrade linux-image-gcp-64kUpgrade linux-image-6.11.0-1014-lowlatency-64kUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-oracle-64kUpgrade linux-image-6.11.0-1022-oemUpgrade linux-image-6.11.0-26-genericUpgrade linux-image-azureUpgrade linux-image-6.11.0-1016-oracleUpgrade linux-image-oracleUpgrade linux-image-lowlatency-64kUpgrade linux-image-6.11.0-1015-gcp-64kUpgrade linux-image-lowlatencyUpgrade linux-image-6.11.0-1014-awsUpgrade linux-image-6.11.0-1013-raspiUpgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-6.11.0-1015-azure-fdeUpgrade linux-image-6.11.0-1015-azureUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.11.0-1014-lowlatencyUpgrade linux-image-6.11.0-1015-gcpUpgrade linux-image-virtualUpgrade linux-image-6.11.0-1010-realtimeUpgrade linux-image-genericUpgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-6.11.0-26-generic-64kUpgrade linux-image-awsUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.11.0-1016-oracle-64kUpgrade linux-image-gcpUpgrade linux-image-oem-24.04b | May 21, 2025 | Feb 27, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub