Vulnerability-Lookup

GHSA-4FJC-772G-JPJ6

Vulnerability from github – Published: 2025-09-05 18:31 – Updated: 2025-11-24 21:30

Details

In the Linux kernel, the following vulnerability has been resolved:

iommufd: Prevent ALIGN() overflow

When allocating IOVA the candidate range gets aligned to the target alignment. If the range is close to ULONG_MAX then the ALIGN() can wrap resulting in a corrupted iova.

Open code the ALIGN() using get_add_overflow() to prevent this. This simplifies the checks as we don't need to check for length earlier either.

Consolidate the two copies of this code under a single helper.

This bug would allow userspace to create a mapping that overlaps with some other mapping or a reserved range.

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-38688"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-04T16:15:36Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\niommufd: Prevent ALIGN() overflow\n\nWhen allocating IOVA the candidate range gets aligned to the target\nalignment. If the range is close to ULONG_MAX then the ALIGN() can\nwrap resulting in a corrupted iova.\n\nOpen code the ALIGN() using get_add_overflow() to prevent this.\nThis simplifies the checks as we don\u0027t need to check for length earlier\neither.\n\nConsolidate the two copies of this code under a single helper.\n\nThis bug would allow userspace to create a mapping that overlaps with some\nother mapping or a reserved range.",
  "id": "GHSA-4fjc-772g-jpj6",
  "modified": "2025-11-24T21:30:56Z",
  "published": "2025-09-05T18:31:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-38688"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/79fad1917802c28de51a479318a056a6fbe3e2f2"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b42497e3c0e74db061eafad41c0cd7243c46436b"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d19b817540c0abe84854a64ee9ee34cecc3bbeef"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e42a046bb41dcdde4f766a17d8211842007ed537"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ebb6021560b94649bec6b8faba6fe0dca2218e81"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2025-38688 (GCVE-0-2025-38688)

Vulnerability from cvelistv5 – Published: 2025-09-04 15:32 – Updated: 2026-08-05 12:03

Title

iommufd: Prevent ALIGN() overflow

Summary

In the Linux kernel, the following vulnerability has been resolved: iommufd: Prevent ALIGN() overflow When allocating IOVA the candidate range gets aligned to the target alignment. If the range is close to ULONG_MAX then the ALIGN() can wrap resulting in a corrupted iova. Open code the ALIGN() using get_add_overflow() to prevent this. This simplifies the checks as we don't need to check for length earlier either. Consolidate the two copies of this code under a single helper. This bug would allow userspace to create a mapping that overlaps with some other mapping or a reserved range.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Assigner

Linux mitre root

References

5 references

URL	Tags
https://git.kernel.org/stable/c/d19b817540c0abe84…
https://git.kernel.org/stable/c/ebb6021560b94649b…
https://git.kernel.org/stable/c/e42a046bb41dcdde4…
https://git.kernel.org/stable/c/79fad1917802c28de…
https://git.kernel.org/stable/c/b42497e3c0e74db06…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 51fe6141f0f64ae0bbc096a41a07572273e8c0ef , < d19b817540c0abe84854a64ee9ee34cecc3bbeef (git) Affected: 51fe6141f0f64ae0bbc096a41a07572273e8c0ef , < ebb6021560b94649bec6b8faba6fe0dca2218e81 (git) Affected: 51fe6141f0f64ae0bbc096a41a07572273e8c0ef , < e42a046bb41dcdde4f766a17d8211842007ed537 (git) Affected: 51fe6141f0f64ae0bbc096a41a07572273e8c0ef , < 79fad1917802c28de51a479318a056a6fbe3e2f2 (git) Affected: 51fe6141f0f64ae0bbc096a41a07572273e8c0ef , < b42497e3c0e74db061eafad41c0cd7243c46436b (git)
Linux	Linux	Affected: 6.2 Unaffected: 0 , < 6.2 (semver) Unaffected: 6.6.103 , ≤ 6.6.* (semver) Unaffected: 6.12.43 , ≤ 6.12.* (semver) Unaffected: 6.15.11 , ≤ 6.15.* (semver) Unaffected: 6.16.2 , ≤ 6.16.* (semver) Unaffected: 6.17 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/iommufd/io_pagetable.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d19b817540c0abe84854a64ee9ee34cecc3bbeef",
              "status": "affected",
              "version": "51fe6141f0f64ae0bbc096a41a07572273e8c0ef",
              "versionType": "git"
            },
            {
              "lessThan": "ebb6021560b94649bec6b8faba6fe0dca2218e81",
              "status": "affected",
              "version": "51fe6141f0f64ae0bbc096a41a07572273e8c0ef",
              "versionType": "git"
            },
            {
              "lessThan": "e42a046bb41dcdde4f766a17d8211842007ed537",
              "status": "affected",
              "version": "51fe6141f0f64ae0bbc096a41a07572273e8c0ef",
              "versionType": "git"
            },
            {
              "lessThan": "79fad1917802c28de51a479318a056a6fbe3e2f2",
              "status": "affected",
              "version": "51fe6141f0f64ae0bbc096a41a07572273e8c0ef",
              "versionType": "git"
            },
            {
              "lessThan": "b42497e3c0e74db061eafad41c0cd7243c46436b",
              "status": "affected",
              "version": "51fe6141f0f64ae0bbc096a41a07572273e8c0ef",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/iommufd/io_pagetable.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.43",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.103",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.43",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.11",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.2",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommufd: Prevent ALIGN() overflow\n\nWhen allocating IOVA the candidate range gets aligned to the target\nalignment. If the range is close to ULONG_MAX then the ALIGN() can\nwrap resulting in a corrupted iova.\n\nOpen code the ALIGN() using get_add_overflow() to prevent this.\nThis simplifies the checks as we don\u0027t need to check for length earlier\neither.\n\nConsolidate the two copies of this code under a single helper.\n\nThis bug would allow userspace to create a mapping that overlaps with some\nother mapping or a reserved range."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable allocator is reached only through ioctl() on an iommufd character device (/dev/iommu, or /dev/vfio/vfio which shares iommufd_fops), requiring local system access. There is no network-facing path to iopt_alloc_iova().\nAC:L - The overflow is deterministic integer arithmetic on fully attacker-chosen inputs \u2014 user_va controls iova_alignment via __ffs64(), length controls roundup_pow_of_two(), and IOMMU_IOAS_MAP_FIXED_IOVA/IOMMU_IOAS_ALLOW_IOVAS let the attacker place a span at the top of the address space. No race, no memory-layout luck; syzbot produced a reproducer.\nPR:L - Any local user holding an iommufd fd can drive IOMMU_IOAS_ALLOC and IOMMU_IOAS_MAP; iommufd_fops_ioctl() dispatches the entire native ioctl table with no capable() gate, and main.c registers /dev/vfio/vfio with mode 0666 using the same fops. No root or real capability is required.\nUI:N - The attacker performs the entire sequence of ioctls itself against its own iommufd context. No victim action or cooperation is needed.\nS:C - The corrupted IOVA lets userspace install a mapping overlapping iopt-\u003ereserved_itree entries (IOMMU_RESV_MSI doorbells, IOMMU_RESV_SW_MSI, RMRR/IOMMU_RESV_DIRECT) \u2014 precisely the ranges that enforce the IOMMU/DMA protection boundary \u2014 and to place mappings outside the VMM-declared allowed IOVA set. Device DMA thereby reaches host resources outside the iommufd context\u0027s security authority, a DMA/IOMMU boundary bypass.\nC:H - The bogus IOVA yields a mapping covering memory the caller was never granted, and the resulting divergence between IOMMU page tables and pinned-page accounting can leave device-readable PTEs on freed and reallocated pages, giving an attacker-programmed DMA engine an arbitrary kernel-memory read primitive.\nI:H - The same overlapping mapping is writable, so device DMA can modify memory outside the sanctioned region \u2014 including reserved ranges and pages the kernel has freed and handed to other subsystems \u2014 and the overlapping area_itree entries corrupt iommufd\u0027s own mapping state, yielding an arbitrary write usable for control-flow hijack.\nA:H - Overlapping iommu_map() trips WARN_ON plus -EEXIST in arm_lpae_init_pte(), and the mismatched teardown trips WARN_ON(ret != size) in iommu_unmap_nofail(), producing kernel splats (panic under panic_on_warn); DMA into freed pages and unhandled IOMMU faults crash the system outright."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:03:58.988Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d19b817540c0abe84854a64ee9ee34cecc3bbeef"
        },
        {
          "url": "https://git.kernel.org/stable/c/ebb6021560b94649bec6b8faba6fe0dca2218e81"
        },
        {
          "url": "https://git.kernel.org/stable/c/e42a046bb41dcdde4f766a17d8211842007ed537"
        },
        {
          "url": "https://git.kernel.org/stable/c/79fad1917802c28de51a479318a056a6fbe3e2f2"
        },
        {
          "url": "https://git.kernel.org/stable/c/b42497e3c0e74db061eafad41c0cd7243c46436b"
        }
      ],
      "title": "iommufd: Prevent ALIGN() overflow",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38688",
    "datePublished": "2025-09-04T15:32:42.607Z",
    "dateReserved": "2025-04-16T04:51:24.032Z",
    "dateUpdated": "2026-08-05T12:03:58.988Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.