Vulnerability-Lookup

FKIE_CVE-2025-39961

Vulnerability from fkie_nvd - Published: 2025-10-09 13:15 - Updated: 2026-10-19 21:10

Severity

8.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
4.7 (Medium) - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: iommu/amd/pgtbl: Fix possible race while increase page table level The AMD IOMMU host page table implementation supports dynamic page table levels (up to 6 levels), starting with a 3-level configuration that expands based on IOVA address. The kernel maintains a root pointer and current page table level to enable proper page table walks in alloc_pte()/fetch_pte() operations. The IOMMU IOVA allocator initially starts with 32-bit address and onces its exhuasted it switches to 64-bit address (max address is determined based on IOMMU and device DMA capability). To support larger IOVA, AMD IOMMU driver increases page table level. But in unmap path (iommu_v1_unmap_pages()), fetch_pte() reads pgtable->[root/mode] without lock. So its possible that in exteme corner case, when increase_address_space() is updating pgtable->[root/mode], fetch_pte() reads wrong page table level (pgtable->mode). It does compare the value with level encoded in page table and returns NULL. This will result is iommu_unmap ops to fail and upper layer may retry/log WARN_ON. CPU 0 CPU 1 ------ ------ map pages unmap pages alloc_pte() -> increase_address_space() iommu_v1_unmap_pages() -> fetch_pte() pgtable->root = pte (new root value) READ pgtable->[mode/root] Reads new root, old mode Updates mode (pgtable->mode += 1) Since Page table level updates are infrequent and already synchronized with a spinlock, implement seqcount to enable lock-free read operations on the read path.

References

URL	Tags
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/075abf0b1a958acfbea2435003d228e738e90346	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/1e56310b40fd2e7e0b9493da9ff488af145bdd0c	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/7d462bdecb7d9c32934dab44aaeb7ea7d73a27a2	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/cd92c8ab336c3a633d46e6f35ebcd3509ae7db3b	Patch

Impacted products

Vendor	Product	Version
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	5.3
linux	linux_kernel	5.3
linux	linux_kernel	6.17
linux	linux_kernel	6.17
linux	linux_kernel	6.17
linux	linux_kernel	6.17
linux	linux_kernel	6.17
linux	linux_kernel	6.17

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/amd/amd_iommu_types.h",
            "drivers/iommu/amd/io_pgtable.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "075abf0b1a958acfbea2435003d228e738e90346",
              "status": "affected",
              "version": "754265bcab78a9014f0f99cd35e0d610fcd7dfa7",
              "versionType": "git"
            },
            {
              "lessThan": "cd92c8ab336c3a633d46e6f35ebcd3509ae7db3b",
              "status": "affected",
              "version": "754265bcab78a9014f0f99cd35e0d610fcd7dfa7",
              "versionType": "git"
            },
            {
              "lessThan": "7d462bdecb7d9c32934dab44aaeb7ea7d73a27a2",
              "status": "affected",
              "version": "754265bcab78a9014f0f99cd35e0d610fcd7dfa7",
              "versionType": "git"
            },
            {
              "lessThan": "1e56310b40fd2e7e0b9493da9ff488af145bdd0c",
              "status": "affected",
              "version": "754265bcab78a9014f0f99cd35e0d610fcd7dfa7",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "6fb92f18555a7b8e085267d513612dc0ff9a5360",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b15bf74405faa1a65025eb8a6eb337e140e5250a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0d50f7b1e8c80a8c20db5049e269468c059b0378",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "785ca708a908b9c596ede852470ba28b8dc3e40b",
              "versionType": "git"
            },
            {
              "lessThan": "4.10",
              "status": "affected",
              "version": "4.9.194",
              "versionType": "semver"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.146",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.75",
              "versionType": "semver"
            },
            {
              "lessThan": "5.3",
              "status": "affected",
              "version": "5.2.17",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/amd/amd_iommu_types.h",
            "drivers/iommu/amd/io_pgtable.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.3"
            },
            {
              "lessThan": "5.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.108",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.49",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "2572FA5E-845E-4DF3-9D9C-8918ECC777C8",
              "versionEndExcluding": "4.10",
              "versionStartIncluding": "4.9.194",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F1F3489C-0F08-4C44-9AFD-D45E286F51D3",
              "versionEndExcluding": "4.15",
              "versionStartIncluding": "4.14.146",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "5EC25515-A753-47F9-823B-4483BE60F328",
              "versionEndExcluding": "4.20",
              "versionStartIncluding": "4.19.75",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C42AB381-30AB-4C50-8C95-A4BFAF431AFB",
              "versionEndExcluding": "5.3",
              "versionStartIncluding": "5.2.17",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "983311BA-7332-42E8-9C1F-71C82FC23C03",
              "versionEndExcluding": "6.6.108",
              "versionStartIncluding": "5.3.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "CAA033E9-A2C5-4976-A83E-9804D8FB827F",
              "versionEndExcluding": "6.12.49",
              "versionStartIncluding": "6.7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "638DD910-1189-4F5E-98BF-2D436B695112",
              "versionEndExcluding": "6.16.9",
              "versionStartIncluding": "6.13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:5.3:-:*:*:*:*:*:*",
              "matchCriteriaId": "D036D76E-AC69-4382-B4C1-8EDA1ABB2941",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:5.3:rc8:*:*:*:*:*:*",
              "matchCriteriaId": "999345BA-F820-40B9-A711-32CA9265C289",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "327D22EF-390B-454C-BD31-2ED23C998A1C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "C730CD9A-D969-4A8E-9522-162AAF7C0EE9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc3:*:*:*:*:*:*",
              "matchCriteriaId": "39982C4B-716E-4B2F-8196-FA301F47807D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc4:*:*:*:*:*:*",
              "matchCriteriaId": "340BEEA9-D70D-4290-B502-FBB1032353B1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc5:*:*:*:*:*:*",
              "matchCriteriaId": "47E4C5C0-079F-4838-971B-8C503D48FCC2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc6:*:*:*:*:*:*",
              "matchCriteriaId": "5A4516A6-C12E-42A4-8C0E-68AEF3264504",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/amd/pgtbl: Fix possible race while increase page table level\n\nThe AMD IOMMU host page table implementation supports dynamic page table levels\n(up to 6 levels), starting with a 3-level configuration that expands based on\nIOVA address. The kernel maintains a root pointer and current page table level\nto enable proper page table walks in alloc_pte()/fetch_pte() operations.\n\nThe IOMMU IOVA allocator initially starts with 32-bit address and onces its\nexhuasted it switches to 64-bit address (max address is determined based\non IOMMU and device DMA capability). To support larger IOVA, AMD IOMMU\ndriver increases page table level.\n\nBut in unmap path (iommu_v1_unmap_pages()), fetch_pte() reads\npgtable-\u003e[root/mode] without lock. So its possible that in exteme corner case,\nwhen increase_address_space() is updating pgtable-\u003e[root/mode], fetch_pte()\nreads wrong page table level (pgtable-\u003emode). It does compare the value with\nlevel encoded in page table and returns NULL. This will result is\niommu_unmap ops to fail and upper layer may retry/log WARN_ON.\n\nCPU 0                                         CPU 1\n------                                       ------\nmap pages                                    unmap pages\nalloc_pte() -\u003e increase_address_space()      iommu_v1_unmap_pages() -\u003e fetch_pte()\n  pgtable-\u003eroot = pte (new root value)\n                                             READ pgtable-\u003e[mode/root]\n\t\t\t\t\t       Reads new root, old mode\n  Updates mode (pgtable-\u003emode += 1)\n\nSince Page table level updates are infrequent and already synchronized with a\nspinlock, implement seqcount to enable lock-free read operations on the read path."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\niommu/amd/pgtbl: Corrige una posible condici\u00f3n de carrera al aumentar el nivel de la tabla de p\u00e1ginas\n\nLa implementaci\u00f3n de la tabla de p\u00e1ginas de host de AMD IOMMU soporta niveles de tabla de p\u00e1ginas din\u00e1micos (hasta 6 niveles), comenzando con una configuraci\u00f3n de 3 niveles que se expande bas\u00e1ndose en la direcci\u00f3n IOVA. El kernel mantiene un puntero ra\u00edz y el nivel actual de la tabla de p\u00e1ginas para permitir recorridos adecuados de la tabla de p\u00e1ginas en las operaciones alloc_pte()/fetch_pte().\n\nEl asignador IOVA de IOMMU inicialmente comienza con una direcci\u00f3n de 32 bits y una vez que se agota, cambia a una direcci\u00f3n de 64 bits (la direcci\u00f3n m\u00e1xima se determina bas\u00e1ndose en la capacidad DMA del IOMMU y del dispositivo). Para soportar IOVA m\u00e1s grandes, el controlador AMD IOMMU aumenta el nivel de la tabla de p\u00e1ginas.\n\nPero en la ruta de desmapeo (iommu_v1_unmap_pages()), fetch_pte() lee pgtable-\u003e[root/mode] sin bloqueo. As\u00ed que es posible que en un caso extremo, cuando increase_address_space() est\u00e1 actualizando pgtable-\u003e[root/mode], fetch_pte() lea un nivel de tabla de p\u00e1ginas incorrecto (pgtable-\u003emode). Compara el valor con el nivel codificado en la tabla de p\u00e1ginas y devuelve NULL. Esto resultar\u00e1 en que las operaciones iommu_unmap fallen y la capa superior puede reintentar/registrar WARN_ON.\n\nCPU 0                                         CPU 1\n------                                       ------\nmapear p\u00e1ginas                                desmapear p\u00e1ginas\nalloc_pte() -\u003e increase_address_space()      iommu_v1_unmap_pages() -\u003e fetch_pte()\n  pgtable-\u003eroot = pte (nuevo valor ra\u00edz)\n                                             LEER pgtable-\u003e[mode/root]\n\t\t\t\t\t       Lee nueva ra\u00edz, modo antiguo\n  Actualiza el modo (pgtable-\u003emode += 1)\n\nDado que las actualizaciones del nivel de la tabla de p\u00e1ginas son poco frecuentes y ya est\u00e1n sincronizadas con un spinlock, se implementa seqcount para habilitar operaciones de lectura sin bloqueo en la ruta de lectura."
    }
  ],
  "id": "CVE-2025-39961",
  "lastModified": "2026-10-19T21:10:00.160",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.0,
        "impactScore": 6.0,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 4.7,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.0,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-39961",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-10-15T21:55:10.295299Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-10-09T13:15:32.250",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/075abf0b1a958acfbea2435003d228e738e90346"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/1e56310b40fd2e7e0b9493da9ff488af145bdd0c"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/7d462bdecb7d9c32934dab44aaeb7ea7d73a27a2"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/cd92c8ab336c3a633d46e6f35ebcd3509ae7db3b"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-362"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2025-39961 (GCVE-0-2025-39961)

Vulnerability from cvelistv5 – Published: 2025-10-09 12:13 – Updated: 2026-10-15 22:02

Title

iommu/amd/pgtbl: Fix possible race while increase page table level

Summary

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 21:55 UTC

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 7033 records in the last 180 days details

References

4 references

URL	Tags
https://git.kernel.org/stable/c/075abf0b1a958acfb…
https://git.kernel.org/stable/c/cd92c8ab336c3a633…
https://git.kernel.org/stable/c/7d462bdecb7d9c329…
https://git.kernel.org/stable/c/1e56310b40fd2e7e0…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 754265bcab78a9014f0f99cd35e0d610fcd7dfa7 , < 075abf0b1a958acfbea2435003d228e738e90346 (git) Affected: 754265bcab78a9014f0f99cd35e0d610fcd7dfa7 , < cd92c8ab336c3a633d46e6f35ebcd3509ae7db3b (git) Affected: 754265bcab78a9014f0f99cd35e0d610fcd7dfa7 , < 7d462bdecb7d9c32934dab44aaeb7ea7d73a27a2 (git) Affected: 754265bcab78a9014f0f99cd35e0d610fcd7dfa7 , < 1e56310b40fd2e7e0b9493da9ff488af145bdd0c (git) Affected: 6fb92f18555a7b8e085267d513612dc0ff9a5360 (git) Affected: b15bf74405faa1a65025eb8a6eb337e140e5250a (git) Affected: 0d50f7b1e8c80a8c20db5049e269468c059b0378 (git) Affected: 785ca708a908b9c596ede852470ba28b8dc3e40b (git) Affected: 4.9.194 , < 4.10 (semver) Affected: 4.14.146 , < 4.15 (semver) Affected: 4.19.75 , < 4.20 (semver) Affected: 5.2.17 , < 5.3 (semver)
Linux	Linux	Affected: 5.3 Unaffected: 0 , < 5.3 (semver) Unaffected: 6.6.108 , ≤ 6.6.* (semver) Unaffected: 6.12.49 , ≤ 6.12.* (semver) Unaffected: 6.16.9 , ≤ 6.16.* (semver) Unaffected: 6.17 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-39961",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T21:55:10.295299Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T22:02:34.065Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/amd/amd_iommu_types.h",
            "drivers/iommu/amd/io_pgtable.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "075abf0b1a958acfbea2435003d228e738e90346",
              "status": "affected",
              "version": "754265bcab78a9014f0f99cd35e0d610fcd7dfa7",
              "versionType": "git"
            },
            {
              "lessThan": "cd92c8ab336c3a633d46e6f35ebcd3509ae7db3b",
              "status": "affected",
              "version": "754265bcab78a9014f0f99cd35e0d610fcd7dfa7",
              "versionType": "git"
            },
            {
              "lessThan": "7d462bdecb7d9c32934dab44aaeb7ea7d73a27a2",
              "status": "affected",
              "version": "754265bcab78a9014f0f99cd35e0d610fcd7dfa7",
              "versionType": "git"
            },
            {
              "lessThan": "1e56310b40fd2e7e0b9493da9ff488af145bdd0c",
              "status": "affected",
              "version": "754265bcab78a9014f0f99cd35e0d610fcd7dfa7",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "6fb92f18555a7b8e085267d513612dc0ff9a5360",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b15bf74405faa1a65025eb8a6eb337e140e5250a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0d50f7b1e8c80a8c20db5049e269468c059b0378",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "785ca708a908b9c596ede852470ba28b8dc3e40b",
              "versionType": "git"
            },
            {
              "lessThan": "4.10",
              "status": "affected",
              "version": "4.9.194",
              "versionType": "semver"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.146",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.75",
              "versionType": "semver"
            },
            {
              "lessThan": "5.3",
              "status": "affected",
              "version": "5.2.17",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/amd/amd_iommu_types.h",
            "drivers/iommu/amd/io_pgtable.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.3"
            },
            {
              "lessThan": "5.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.108",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.49",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.108",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.49",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.9",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.9.194",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.146",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.75",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.2.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/amd/pgtbl: Fix possible race while increase page table level\n\nThe AMD IOMMU host page table implementation supports dynamic page table levels\n(up to 6 levels), starting with a 3-level configuration that expands based on\nIOVA address. The kernel maintains a root pointer and current page table level\nto enable proper page table walks in alloc_pte()/fetch_pte() operations.\n\nThe IOMMU IOVA allocator initially starts with 32-bit address and onces its\nexhuasted it switches to 64-bit address (max address is determined based\non IOMMU and device DMA capability). To support larger IOVA, AMD IOMMU\ndriver increases page table level.\n\nBut in unmap path (iommu_v1_unmap_pages()), fetch_pte() reads\npgtable-\u003e[root/mode] without lock. So its possible that in exteme corner case,\nwhen increase_address_space() is updating pgtable-\u003e[root/mode], fetch_pte()\nreads wrong page table level (pgtable-\u003emode). It does compare the value with\nlevel encoded in page table and returns NULL. This will result is\niommu_unmap ops to fail and upper layer may retry/log WARN_ON.\n\nCPU 0                                         CPU 1\n------                                       ------\nmap pages                                    unmap pages\nalloc_pte() -\u003e increase_address_space()      iommu_v1_unmap_pages() -\u003e fetch_pte()\n  pgtable-\u003eroot = pte (new root value)\n                                             READ pgtable-\u003e[mode/root]\n\t\t\t\t\t       Reads new root, old mode\n  Updates mode (pgtable-\u003emode += 1)\n\nSince Page table level updates are infrequent and already synchronized with a\nspinlock, implement seqcount to enable lock-free read operations on the read path."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The race is reached through local DMA-mapping activity \u2014 either VFIO/iommufd map/unmap ioctls or ordinary syscall-driven I/O that exercises dma_map/dma_unmap on a device behind the AMD IOMMU. No network protocol handler processes remote data on this path.\nAC:L - The attacker controls both sides of the race: one thread issues a high-IOVA map that forces increase_address_space() while other threads issue concurrent unmaps on the same domain, and the attempt can be repeated indefinitely because each newly created protection_domain restarts at PAGE_MODE_3_LEVEL. No condition depends on state outside the attacker\u0027s influence, and CONFIG_AMD_IOMMU with v1 host page tables is the default on all AMD x86_64 systems.\nPR:L - An unprivileged local user can drive the concurrent map/unmap traffic that exhausts the 32-bit IOVA space and triggers the page-table level increase; in device-assignment deployments the VFIO/iommufd ioctl path is exercised by an unprivileged QEMU process. No root or capability in the init namespace is required.\nUI:N - The race is triggered entirely by the attacker\u0027s own concurrent DMA map/unmap operations. No victim action is needed.\nS:C - A silently-failed iommu_v1_unmap_pages() leaves a live IOMMU translation after __iommu_dma_unmap() frees the IOVA and the driver recycles the buffer, so a DMA-capable device \u2014 including a guest-controlled assigned device \u2014 retains read/write access to host physical memory it must no longer reach. This is an IOMMU/DMA containment bypass that crosses out of the kernel\u0027s own security authority.\nC:H - The stale mapping lets the device read physical pages that have been returned to the allocator and refilled with arbitrary kernel or other-tenant data, giving an unbounded read primitive over reused memory; the torn read in alloc_pte() can additionally alias a mapping onto another buffer in the domain.\nI:H - The same stale or mis-installed translation is writable, so the device can DMA arbitrary attacker-chosen data into freed-and-reused kernel memory, yielding a write primitive suitable for control-flow hijacking. The corruption is invisible to the kernel because the unmap was reported as complete.\nA:H - The failed unmap immediately produces WARN_ON splats in __iommu_dma_unmap()/iommu_unmap_nofail() (a panic with panic_on_warn), and the resulting DMA into recycled memory or the mis-built page-table subtree causes IO page faults, page-table page leaks, and kernel crashes."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:06:29.974Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/075abf0b1a958acfbea2435003d228e738e90346"
        },
        {
          "url": "https://git.kernel.org/stable/c/cd92c8ab336c3a633d46e6f35ebcd3509ae7db3b"
        },
        {
          "url": "https://git.kernel.org/stable/c/7d462bdecb7d9c32934dab44aaeb7ea7d73a27a2"
        },
        {
          "url": "https://git.kernel.org/stable/c/1e56310b40fd2e7e0b9493da9ff488af145bdd0c"
        }
      ],
      "title": "iommu/amd/pgtbl: Fix possible race while increase page table level",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39961",
    "datePublished": "2025-10-09T12:13:22.029Z",
    "dateReserved": "2025-04-16T07:20:57.149Z",
    "dateUpdated": "2026-10-15T22:02:34.065Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted