CVE-2025-39961 (GCVE-0-2025-39961)

Vulnerability from cvelistv5 – Published: 2025-10-09 12:13 – Updated: 2026-10-15 22:02
VLAI
Title
iommu/amd/pgtbl: Fix possible race while increase page table level
Summary
In the Linux kernel, the following vulnerability has been resolved: iommu/amd/pgtbl: Fix possible race while increase page table level The AMD IOMMU host page table implementation supports dynamic page table levels (up to 6 levels), starting with a 3-level configuration that expands based on IOVA address. The kernel maintains a root pointer and current page table level to enable proper page table walks in alloc_pte()/fetch_pte() operations. The IOMMU IOVA allocator initially starts with 32-bit address and onces its exhuasted it switches to 64-bit address (max address is determined based on IOMMU and device DMA capability). To support larger IOVA, AMD IOMMU driver increases page table level. But in unmap path (iommu_v1_unmap_pages()), fetch_pte() reads pgtable->[root/mode] without lock. So its possible that in exteme corner case, when increase_address_space() is updating pgtable->[root/mode], fetch_pte() reads wrong page table level (pgtable->mode). It does compare the value with level encoded in page table and returns NULL. This will result is iommu_unmap ops to fail and upper layer may retry/log WARN_ON. CPU 0 CPU 1 ------ ------ map pages unmap pages alloc_pte() -> increase_address_space() iommu_v1_unmap_pages() -> fetch_pte() pgtable->root = pte (new root value) READ pgtable->[mode/root] Reads new root, old mode Updates mode (pgtable->mode += 1) Since Page table level updates are infrequent and already synchronized with a spinlock, implement seqcount to enable lock-free read operations on the read path.
Severity
8.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 21:55 UTC
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 6856 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 754265bcab78a9014f0f99cd35e0d610fcd7dfa7 , < 075abf0b1a958acfbea2435003d228e738e90346 (git)
Affected: 754265bcab78a9014f0f99cd35e0d610fcd7dfa7 , < cd92c8ab336c3a633d46e6f35ebcd3509ae7db3b (git)
Affected: 754265bcab78a9014f0f99cd35e0d610fcd7dfa7 , < 7d462bdecb7d9c32934dab44aaeb7ea7d73a27a2 (git)
Affected: 754265bcab78a9014f0f99cd35e0d610fcd7dfa7 , < 1e56310b40fd2e7e0b9493da9ff488af145bdd0c (git)
Affected: 6fb92f18555a7b8e085267d513612dc0ff9a5360 (git)
Affected: b15bf74405faa1a65025eb8a6eb337e140e5250a (git)
Affected: 0d50f7b1e8c80a8c20db5049e269468c059b0378 (git)
Affected: 785ca708a908b9c596ede852470ba28b8dc3e40b (git)
Affected: 4.9.194 , < 4.10 (semver)
Affected: 4.14.146 , < 4.15 (semver)
Affected: 4.19.75 , < 4.20 (semver)
Affected: 5.2.17 , < 5.3 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.3
Unaffected: 0 , < 5.3 (semver)
Unaffected: 6.6.108 , ≤ 6.6.* (semver)
Unaffected: 6.12.49 , ≤ 6.12.* (semver)
Unaffected: 6.16.9 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-39961",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T21:55:10.295299Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T22:02:34.065Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/amd/amd_iommu_types.h",
            "drivers/iommu/amd/io_pgtable.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "075abf0b1a958acfbea2435003d228e738e90346",
              "status": "affected",
              "version": "754265bcab78a9014f0f99cd35e0d610fcd7dfa7",
              "versionType": "git"
            },
            {
              "lessThan": "cd92c8ab336c3a633d46e6f35ebcd3509ae7db3b",
              "status": "affected",
              "version": "754265bcab78a9014f0f99cd35e0d610fcd7dfa7",
              "versionType": "git"
            },
            {
              "lessThan": "7d462bdecb7d9c32934dab44aaeb7ea7d73a27a2",
              "status": "affected",
              "version": "754265bcab78a9014f0f99cd35e0d610fcd7dfa7",
              "versionType": "git"
            },
            {
              "lessThan": "1e56310b40fd2e7e0b9493da9ff488af145bdd0c",
              "status": "affected",
              "version": "754265bcab78a9014f0f99cd35e0d610fcd7dfa7",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "6fb92f18555a7b8e085267d513612dc0ff9a5360",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b15bf74405faa1a65025eb8a6eb337e140e5250a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0d50f7b1e8c80a8c20db5049e269468c059b0378",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "785ca708a908b9c596ede852470ba28b8dc3e40b",
              "versionType": "git"
            },
            {
              "lessThan": "4.10",
              "status": "affected",
              "version": "4.9.194",
              "versionType": "semver"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.146",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.75",
              "versionType": "semver"
            },
            {
              "lessThan": "5.3",
              "status": "affected",
              "version": "5.2.17",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/amd/amd_iommu_types.h",
            "drivers/iommu/amd/io_pgtable.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.3"
            },
            {
              "lessThan": "5.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.108",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.49",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.108",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.49",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.9",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.9.194",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.146",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.75",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.2.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/amd/pgtbl: Fix possible race while increase page table level\n\nThe AMD IOMMU host page table implementation supports dynamic page table levels\n(up to 6 levels), starting with a 3-level configuration that expands based on\nIOVA address. The kernel maintains a root pointer and current page table level\nto enable proper page table walks in alloc_pte()/fetch_pte() operations.\n\nThe IOMMU IOVA allocator initially starts with 32-bit address and onces its\nexhuasted it switches to 64-bit address (max address is determined based\non IOMMU and device DMA capability). To support larger IOVA, AMD IOMMU\ndriver increases page table level.\n\nBut in unmap path (iommu_v1_unmap_pages()), fetch_pte() reads\npgtable-\u003e[root/mode] without lock. So its possible that in exteme corner case,\nwhen increase_address_space() is updating pgtable-\u003e[root/mode], fetch_pte()\nreads wrong page table level (pgtable-\u003emode). It does compare the value with\nlevel encoded in page table and returns NULL. This will result is\niommu_unmap ops to fail and upper layer may retry/log WARN_ON.\n\nCPU 0                                         CPU 1\n------                                       ------\nmap pages                                    unmap pages\nalloc_pte() -\u003e increase_address_space()      iommu_v1_unmap_pages() -\u003e fetch_pte()\n  pgtable-\u003eroot = pte (new root value)\n                                             READ pgtable-\u003e[mode/root]\n\t\t\t\t\t       Reads new root, old mode\n  Updates mode (pgtable-\u003emode += 1)\n\nSince Page table level updates are infrequent and already synchronized with a\nspinlock, implement seqcount to enable lock-free read operations on the read path."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The race is reached through local DMA-mapping activity \u2014 either VFIO/iommufd map/unmap ioctls or ordinary syscall-driven I/O that exercises dma_map/dma_unmap on a device behind the AMD IOMMU. No network protocol handler processes remote data on this path.\nAC:L - The attacker controls both sides of the race: one thread issues a high-IOVA map that forces increase_address_space() while other threads issue concurrent unmaps on the same domain, and the attempt can be repeated indefinitely because each newly created protection_domain restarts at PAGE_MODE_3_LEVEL. No condition depends on state outside the attacker\u0027s influence, and CONFIG_AMD_IOMMU with v1 host page tables is the default on all AMD x86_64 systems.\nPR:L - An unprivileged local user can drive the concurrent map/unmap traffic that exhausts the 32-bit IOVA space and triggers the page-table level increase; in device-assignment deployments the VFIO/iommufd ioctl path is exercised by an unprivileged QEMU process. No root or capability in the init namespace is required.\nUI:N - The race is triggered entirely by the attacker\u0027s own concurrent DMA map/unmap operations. No victim action is needed.\nS:C - A silently-failed iommu_v1_unmap_pages() leaves a live IOMMU translation after __iommu_dma_unmap() frees the IOVA and the driver recycles the buffer, so a DMA-capable device \u2014 including a guest-controlled assigned device \u2014 retains read/write access to host physical memory it must no longer reach. This is an IOMMU/DMA containment bypass that crosses out of the kernel\u0027s own security authority.\nC:H - The stale mapping lets the device read physical pages that have been returned to the allocator and refilled with arbitrary kernel or other-tenant data, giving an unbounded read primitive over reused memory; the torn read in alloc_pte() can additionally alias a mapping onto another buffer in the domain.\nI:H - The same stale or mis-installed translation is writable, so the device can DMA arbitrary attacker-chosen data into freed-and-reused kernel memory, yielding a write primitive suitable for control-flow hijacking. The corruption is invisible to the kernel because the unmap was reported as complete.\nA:H - The failed unmap immediately produces WARN_ON splats in __iommu_dma_unmap()/iommu_unmap_nofail() (a panic with panic_on_warn), and the resulting DMA into recycled memory or the mis-built page-table subtree causes IO page faults, page-table page leaks, and kernel crashes."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:06:29.974Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/075abf0b1a958acfbea2435003d228e738e90346"
        },
        {
          "url": "https://git.kernel.org/stable/c/cd92c8ab336c3a633d46e6f35ebcd3509ae7db3b"
        },
        {
          "url": "https://git.kernel.org/stable/c/7d462bdecb7d9c32934dab44aaeb7ea7d73a27a2"
        },
        {
          "url": "https://git.kernel.org/stable/c/1e56310b40fd2e7e0b9493da9ff488af145bdd0c"
        }
      ],
      "title": "iommu/amd/pgtbl: Fix possible race while increase page table level",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39961",
    "datePublished": "2025-10-09T12:13:22.029Z",
    "dateReserved": "2025-04-16T07:20:57.149Z",
    "dateUpdated": "2026-10-15T22:02:34.065Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-39961",
      "date": "2026-10-21",
      "epss": "0.00115",
      "percentile": "0.01464"
    },
    "microsoft_vex": {
      "current_release_date": "2025-10-11T01:01:50.000Z",
      "cve": "CVE-2025-39961",
      "id": "msrc_CVE-2025-39961",
      "initial_release_date": "2025-10-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "iommu/amd/pgtbl: Fix possible race while increase page table level",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-39961.json",
      "version": "1"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/iommu/amd/amd_iommu_types.h",
                  "drivers/iommu/amd/io_pgtable.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "075abf0b1a958acfbea2435003d228e738e90346",
                    "status": "affected",
                    "version": "754265bcab78a9014f0f99cd35e0d610fcd7dfa7",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "cd92c8ab336c3a633d46e6f35ebcd3509ae7db3b",
                    "status": "affected",
                    "version": "754265bcab78a9014f0f99cd35e0d610fcd7dfa7",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7d462bdecb7d9c32934dab44aaeb7ea7d73a27a2",
                    "status": "affected",
                    "version": "754265bcab78a9014f0f99cd35e0d610fcd7dfa7",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1e56310b40fd2e7e0b9493da9ff488af145bdd0c",
                    "status": "affected",
                    "version": "754265bcab78a9014f0f99cd35e0d610fcd7dfa7",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "6fb92f18555a7b8e085267d513612dc0ff9a5360",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "b15bf74405faa1a65025eb8a6eb337e140e5250a",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "0d50f7b1e8c80a8c20db5049e269468c059b0378",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "785ca708a908b9c596ede852470ba28b8dc3e40b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4.10",
                    "status": "affected",
                    "version": "4.9.194",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "4.15",
                    "status": "affected",
                    "version": "4.14.146",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "4.20",
                    "status": "affected",
                    "version": "4.19.75",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.3",
                    "status": "affected",
                    "version": "5.2.17",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/iommu/amd/amd_iommu_types.h",
                  "drivers/iommu/amd/io_pgtable.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.3"
                  },
                  {
                    "lessThan": "5.3",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.108",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.49",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.16.*",
                    "status": "unaffected",
                    "version": "6.16.9",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.17",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2572FA5E-845E-4DF3-9D9C-8918ECC777C8",
                    "versionEndExcluding": "4.10",
                    "versionStartIncluding": "4.9.194",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F1F3489C-0F08-4C44-9AFD-D45E286F51D3",
                    "versionEndExcluding": "4.15",
                    "versionStartIncluding": "4.14.146",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5EC25515-A753-47F9-823B-4483BE60F328",
                    "versionEndExcluding": "4.20",
                    "versionStartIncluding": "4.19.75",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C42AB381-30AB-4C50-8C95-A4BFAF431AFB",
                    "versionEndExcluding": "5.3",
                    "versionStartIncluding": "5.2.17",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "983311BA-7332-42E8-9C1F-71C82FC23C03",
                    "versionEndExcluding": "6.6.108",
                    "versionStartIncluding": "5.3.1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CAA033E9-A2C5-4976-A83E-9804D8FB827F",
                    "versionEndExcluding": "6.12.49",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "638DD910-1189-4F5E-98BF-2D436B695112",
                    "versionEndExcluding": "6.16.9",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.3:-:*:*:*:*:*:*",
                    "matchCriteriaId": "D036D76E-AC69-4382-B4C1-8EDA1ABB2941",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.3:rc8:*:*:*:*:*:*",
                    "matchCriteriaId": "999345BA-F820-40B9-A711-32CA9265C289",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "327D22EF-390B-454C-BD31-2ED23C998A1C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "C730CD9A-D969-4A8E-9522-162AAF7C0EE9",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "39982C4B-716E-4B2F-8196-FA301F47807D",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "340BEEA9-D70D-4290-B502-FBB1032353B1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc5:*:*:*:*:*:*",
                    "matchCriteriaId": "47E4C5C0-079F-4838-971B-8C503D48FCC2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc6:*:*:*:*:*:*",
                    "matchCriteriaId": "5A4516A6-C12E-42A4-8C0E-68AEF3264504",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/amd/pgtbl: Fix possible race while increase page table level\n\nThe AMD IOMMU host page table implementation supports dynamic page table levels\n(up to 6 levels), starting with a 3-level configuration that expands based on\nIOVA address. The kernel maintains a root pointer and current page table level\nto enable proper page table walks in alloc_pte()/fetch_pte() operations.\n\nThe IOMMU IOVA allocator initially starts with 32-bit address and onces its\nexhuasted it switches to 64-bit address (max address is determined based\non IOMMU and device DMA capability). To support larger IOVA, AMD IOMMU\ndriver increases page table level.\n\nBut in unmap path (iommu_v1_unmap_pages()), fetch_pte() reads\npgtable-\u003e[root/mode] without lock. So its possible that in exteme corner case,\nwhen increase_address_space() is updating pgtable-\u003e[root/mode], fetch_pte()\nreads wrong page table level (pgtable-\u003emode). It does compare the value with\nlevel encoded in page table and returns NULL. This will result is\niommu_unmap ops to fail and upper layer may retry/log WARN_ON.\n\nCPU 0                                         CPU 1\n------                                       ------\nmap pages                                    unmap pages\nalloc_pte() -\u003e increase_address_space()      iommu_v1_unmap_pages() -\u003e fetch_pte()\n  pgtable-\u003eroot = pte (new root value)\n                                             READ pgtable-\u003e[mode/root]\n\t\t\t\t\t       Reads new root, old mode\n  Updates mode (pgtable-\u003emode += 1)\n\nSince Page table level updates are infrequent and already synchronized with a\nspinlock, implement seqcount to enable lock-free read operations on the read path."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\niommu/amd/pgtbl: Corrige una posible condici\u00f3n de carrera al aumentar el nivel de la tabla de p\u00e1ginas\n\nLa implementaci\u00f3n de la tabla de p\u00e1ginas de host de AMD IOMMU soporta niveles de tabla de p\u00e1ginas din\u00e1micos (hasta 6 niveles), comenzando con una configuraci\u00f3n de 3 niveles que se expande bas\u00e1ndose en la direcci\u00f3n IOVA. El kernel mantiene un puntero ra\u00edz y el nivel actual de la tabla de p\u00e1ginas para permitir recorridos adecuados de la tabla de p\u00e1ginas en las operaciones alloc_pte()/fetch_pte().\n\nEl asignador IOVA de IOMMU inicialmente comienza con una direcci\u00f3n de 32 bits y una vez que se agota, cambia a una direcci\u00f3n de 64 bits (la direcci\u00f3n m\u00e1xima se determina bas\u00e1ndose en la capacidad DMA del IOMMU y del dispositivo). Para soportar IOVA m\u00e1s grandes, el controlador AMD IOMMU aumenta el nivel de la tabla de p\u00e1ginas.\n\nPero en la ruta de desmapeo (iommu_v1_unmap_pages()), fetch_pte() lee pgtable-\u003e[root/mode] sin bloqueo. As\u00ed que es posible que en un caso extremo, cuando increase_address_space() est\u00e1 actualizando pgtable-\u003e[root/mode], fetch_pte() lea un nivel de tabla de p\u00e1ginas incorrecto (pgtable-\u003emode). Compara el valor con el nivel codificado en la tabla de p\u00e1ginas y devuelve NULL. Esto resultar\u00e1 en que las operaciones iommu_unmap fallen y la capa superior puede reintentar/registrar WARN_ON.\n\nCPU 0                                         CPU 1\n------                                       ------\nmapear p\u00e1ginas                                desmapear p\u00e1ginas\nalloc_pte() -\u003e increase_address_space()      iommu_v1_unmap_pages() -\u003e fetch_pte()\n  pgtable-\u003eroot = pte (nuevo valor ra\u00edz)\n                                             LEER pgtable-\u003e[mode/root]\n\t\t\t\t\t       Lee nueva ra\u00edz, modo antiguo\n  Actualiza el modo (pgtable-\u003emode += 1)\n\nDado que las actualizaciones del nivel de la tabla de p\u00e1ginas son poco frecuentes y ya est\u00e1n sincronizadas con un spinlock, se implementa seqcount para habilitar operaciones de lectura sin bloqueo en la ruta de lectura."
          }
        ],
        "id": "CVE-2025-39961",
        "lastModified": "2026-10-19T21:10:00.160",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.0,
              "impactScore": 6.0,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 4.7,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.0,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-39961",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T21:55:10.295299Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-10-09T13:15:32.250",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/075abf0b1a958acfbea2435003d228e738e90346"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/1e56310b40fd2e7e0b9493da9ff488af145bdd0c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/7d462bdecb7d9c32934dab44aaeb7ea7d73a27a2"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/cd92c8ab336c3a633d46e6f35ebcd3509ae7db3b"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-362"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-21T02:29:29+00:00",
      "cve": "CVE-2025-39961",
      "id": "CVE-2025-39961",
      "initial_release_date": "2025-10-09T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: iommu/amd/pgtbl: Fix possible race while increase page table level",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-39961.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.