CVE-2025-38688 (GCVE-0-2025-38688)

Vulnerability from cvelistv5 – Published: 2025-09-04 15:32 – Updated: 2026-08-05 12:03
VLAI
Title
iommufd: Prevent ALIGN() overflow
Summary
In the Linux kernel, the following vulnerability has been resolved: iommufd: Prevent ALIGN() overflow When allocating IOVA the candidate range gets aligned to the target alignment. If the range is close to ULONG_MAX then the ALIGN() can wrap resulting in a corrupted iova. Open code the ALIGN() using get_add_overflow() to prevent this. This simplifies the checks as we don't need to check for length earlier either. Consolidate the two copies of this code under a single helper. This bug would allow userspace to create a mapping that overlaps with some other mapping or a reserved range.
Severity
8.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 51fe6141f0f64ae0bbc096a41a07572273e8c0ef , < d19b817540c0abe84854a64ee9ee34cecc3bbeef (git)
Affected: 51fe6141f0f64ae0bbc096a41a07572273e8c0ef , < ebb6021560b94649bec6b8faba6fe0dca2218e81 (git)
Affected: 51fe6141f0f64ae0bbc096a41a07572273e8c0ef , < e42a046bb41dcdde4f766a17d8211842007ed537 (git)
Affected: 51fe6141f0f64ae0bbc096a41a07572273e8c0ef , < 79fad1917802c28de51a479318a056a6fbe3e2f2 (git)
Affected: 51fe6141f0f64ae0bbc096a41a07572273e8c0ef , < b42497e3c0e74db061eafad41c0cd7243c46436b (git)
Create a notification for this product.
Linux Linux Affected: 6.2
Unaffected: 0 , < 6.2 (semver)
Unaffected: 6.6.103 , ≤ 6.6.* (semver)
Unaffected: 6.12.43 , ≤ 6.12.* (semver)
Unaffected: 6.15.11 , ≤ 6.15.* (semver)
Unaffected: 6.16.2 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/iommufd/io_pagetable.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d19b817540c0abe84854a64ee9ee34cecc3bbeef",
              "status": "affected",
              "version": "51fe6141f0f64ae0bbc096a41a07572273e8c0ef",
              "versionType": "git"
            },
            {
              "lessThan": "ebb6021560b94649bec6b8faba6fe0dca2218e81",
              "status": "affected",
              "version": "51fe6141f0f64ae0bbc096a41a07572273e8c0ef",
              "versionType": "git"
            },
            {
              "lessThan": "e42a046bb41dcdde4f766a17d8211842007ed537",
              "status": "affected",
              "version": "51fe6141f0f64ae0bbc096a41a07572273e8c0ef",
              "versionType": "git"
            },
            {
              "lessThan": "79fad1917802c28de51a479318a056a6fbe3e2f2",
              "status": "affected",
              "version": "51fe6141f0f64ae0bbc096a41a07572273e8c0ef",
              "versionType": "git"
            },
            {
              "lessThan": "b42497e3c0e74db061eafad41c0cd7243c46436b",
              "status": "affected",
              "version": "51fe6141f0f64ae0bbc096a41a07572273e8c0ef",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/iommufd/io_pagetable.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.43",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.103",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.43",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.11",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.2",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommufd: Prevent ALIGN() overflow\n\nWhen allocating IOVA the candidate range gets aligned to the target\nalignment. If the range is close to ULONG_MAX then the ALIGN() can\nwrap resulting in a corrupted iova.\n\nOpen code the ALIGN() using get_add_overflow() to prevent this.\nThis simplifies the checks as we don\u0027t need to check for length earlier\neither.\n\nConsolidate the two copies of this code under a single helper.\n\nThis bug would allow userspace to create a mapping that overlaps with some\nother mapping or a reserved range."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable allocator is reached only through ioctl() on an iommufd character device (/dev/iommu, or /dev/vfio/vfio which shares iommufd_fops), requiring local system access. There is no network-facing path to iopt_alloc_iova().\nAC:L - The overflow is deterministic integer arithmetic on fully attacker-chosen inputs \u2014 user_va controls iova_alignment via __ffs64(), length controls roundup_pow_of_two(), and IOMMU_IOAS_MAP_FIXED_IOVA/IOMMU_IOAS_ALLOW_IOVAS let the attacker place a span at the top of the address space. No race, no memory-layout luck; syzbot produced a reproducer.\nPR:L - Any local user holding an iommufd fd can drive IOMMU_IOAS_ALLOC and IOMMU_IOAS_MAP; iommufd_fops_ioctl() dispatches the entire native ioctl table with no capable() gate, and main.c registers /dev/vfio/vfio with mode 0666 using the same fops. No root or real capability is required.\nUI:N - The attacker performs the entire sequence of ioctls itself against its own iommufd context. No victim action or cooperation is needed.\nS:C - The corrupted IOVA lets userspace install a mapping overlapping iopt-\u003ereserved_itree entries (IOMMU_RESV_MSI doorbells, IOMMU_RESV_SW_MSI, RMRR/IOMMU_RESV_DIRECT) \u2014 precisely the ranges that enforce the IOMMU/DMA protection boundary \u2014 and to place mappings outside the VMM-declared allowed IOVA set. Device DMA thereby reaches host resources outside the iommufd context\u0027s security authority, a DMA/IOMMU boundary bypass.\nC:H - The bogus IOVA yields a mapping covering memory the caller was never granted, and the resulting divergence between IOMMU page tables and pinned-page accounting can leave device-readable PTEs on freed and reallocated pages, giving an attacker-programmed DMA engine an arbitrary kernel-memory read primitive.\nI:H - The same overlapping mapping is writable, so device DMA can modify memory outside the sanctioned region \u2014 including reserved ranges and pages the kernel has freed and handed to other subsystems \u2014 and the overlapping area_itree entries corrupt iommufd\u0027s own mapping state, yielding an arbitrary write usable for control-flow hijack.\nA:H - Overlapping iommu_map() trips WARN_ON plus -EEXIST in arm_lpae_init_pte(), and the mismatched teardown trips WARN_ON(ret != size) in iommu_unmap_nofail(), producing kernel splats (panic under panic_on_warn); DMA into freed pages and unhandled IOMMU faults crash the system outright."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:03:58.988Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d19b817540c0abe84854a64ee9ee34cecc3bbeef"
        },
        {
          "url": "https://git.kernel.org/stable/c/ebb6021560b94649bec6b8faba6fe0dca2218e81"
        },
        {
          "url": "https://git.kernel.org/stable/c/e42a046bb41dcdde4f766a17d8211842007ed537"
        },
        {
          "url": "https://git.kernel.org/stable/c/79fad1917802c28de51a479318a056a6fbe3e2f2"
        },
        {
          "url": "https://git.kernel.org/stable/c/b42497e3c0e74db061eafad41c0cd7243c46436b"
        }
      ],
      "title": "iommufd: Prevent ALIGN() overflow",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38688",
    "datePublished": "2025-09-04T15:32:42.607Z",
    "dateReserved": "2025-04-16T04:51:24.032Z",
    "dateUpdated": "2026-08-05T12:03:58.988Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38688",
      "date": "2026-08-04",
      "epss": "0.00153",
      "percentile": "0.04961"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T14:11:44.000Z",
      "cve": "CVE-2025-38688",
      "id": "msrc_CVE-2025-38688",
      "initial_release_date": "2025-09-02T00:00:00.000Z",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "iommufd: Prevent ALIGN() overflow",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-38688.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38688\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-09-04T16:15:36.863\",\"lastModified\":\"2026-07-30T06:23:35.243\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\niommufd: Prevent ALIGN() overflow\\n\\nWhen allocating IOVA the candidate range gets aligned to the target\\nalignment. If the range is close to ULONG_MAX then the ALIGN() can\\nwrap resulting in a corrupted iova.\\n\\nOpen code the ALIGN() using get_add_overflow() to prevent this.\\nThis simplifies the checks as we don\u0027t need to check for length earlier\\neither.\\n\\nConsolidate the two copies of this code under a single helper.\\n\\nThis bug would allow userspace to create a mapping that overlaps with some\\nother mapping or a reserved range.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/iommu/iommufd/io_pagetable.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"51fe6141f0f64ae0bbc096a41a07572273e8c0ef\",\"lessThan\":\"d19b817540c0abe84854a64ee9ee34cecc3bbeef\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"51fe6141f0f64ae0bbc096a41a07572273e8c0ef\",\"lessThan\":\"ebb6021560b94649bec6b8faba6fe0dca2218e81\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"51fe6141f0f64ae0bbc096a41a07572273e8c0ef\",\"lessThan\":\"e42a046bb41dcdde4f766a17d8211842007ed537\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"51fe6141f0f64ae0bbc096a41a07572273e8c0ef\",\"lessThan\":\"79fad1917802c28de51a479318a056a6fbe3e2f2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"51fe6141f0f64ae0bbc096a41a07572273e8c0ef\",\"lessThan\":\"b42497e3c0e74db061eafad41c0cd7243c46436b\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/iommu/iommufd/io_pagetable.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.2\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.2\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.103\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.43\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15.11\",\"lessThanOrEqual\":\"6.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16.2\",\"lessThanOrEqual\":\"6.16.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.0,\"impactScore\":6.0},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.103\",\"matchCriteriaId\":\"F2293654-7169-49B5-8D0D-EE51EF8B8E48\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.43\",\"matchCriteriaId\":\"472C5F87-2BF3-4FAB-9B21-DA7513977363\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.15.11\",\"matchCriteriaId\":\"BC242347-F722-43AE-B910-BE0B22386977\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.16\",\"versionEndExcluding\":\"6.16.2\",\"matchCriteriaId\":\"BD7C087D-2415-4521-B624-30003352F899\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/79fad1917802c28de51a479318a056a6fbe3e2f2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b42497e3c0e74db061eafad41c0cd7243c46436b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d19b817540c0abe84854a64ee9ee34cecc3bbeef\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e42a046bb41dcdde4f766a17d8211842007ed537\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ebb6021560b94649bec6b8faba6fe0dca2218e81\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T09:02:46+00:00",
      "cve": "CVE-2025-38688",
      "id": "CVE-2025-38688",
      "initial_release_date": "2025-09-04T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: iommufd: Prevent ALIGN() overflow",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38688.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.