CVE-2025-38062

In the Linux kernel, the following vulnerability has been resolved:

genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie

The IOMMU translation for MSI message addresses has been a 2-step process,
separated in time:

 1) iommu_dma_prepare_msi(): A cookie pointer containing the IOVA address
    is stored in the MSI descriptor when an MSI interrupt is allocated.

 2) iommu_dma_compose_msi_msg(): this cookie pointer is used to compute a
    translated message address.

This has an inherent lifetime problem for the pointer stored in the cookie
that must remain valid between the two steps. However, there is no locking
at the irq layer that helps protect the lifetime. Today, this works under
the assumption that the iommu domain is not changed while MSI interrupts
being programmed. This is true for normal DMA API users within the kernel,
as the iommu domain is attached before the driver is probed and cannot be
changed while a driver is attached.

Classic VFIO type1 also prevented changing the iommu domain while VFIO was
running as it does not support changing the "container" after starting up.

However, iommufd has improved this so that the iommu domain can be changed
during VFIO operation. This potentially allows userspace to directly race
VFIO_DEVICE_ATTACH_IOMMUFD_PT (which calls iommu_attach_group()) and
VFIO_DEVICE_SET_IRQS (which calls into iommu_dma_compose_msi_msg()).

This potentially causes both the cookie pointer and the unlocked call to
iommu_get_domain_for_dev() on the MSI translation path to become UAFs.

Fix the MSI cookie UAF by removing the cookie pointer. The translated IOVA
address is already known during iommu_dma_prepare_msi() and cannot change.
Thus, it can simply be stored as an integer in the MSI descriptor.

The other UAF related to iommu_get_domain_for_dev() will be addressed in
patch "iommu: Make iommu_dma_prepare_msi() into a generic operation" by
using the IOMMU group mutex.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
UNKNOWN
---
LinuxCNA
---
---
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 5%
Debian logo
Debian Releases
Debian Product
Codename
linux
bullseye
vulnerable
bullseye (security)
vulnerable
bookworm
vulnerable
bookworm (security)
vulnerable
trixie (security)
vulnerable
sid
6.12.38-1
fixed
trixie
6.12.38-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
linux-hwe
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
ignored
xenial
ignored
trusty
dne
linux-hwe-5.4
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
ignored
xenial
dne
trusty
dne
linux-hwe-5.8
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
bionic
dne
xenial
dne
trusty
dne
linux-hwe-5.11
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
bionic
dne
xenial
dne
trusty
dne
linux-hwe-5.13
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
bionic
dne
xenial
dne
trusty
dne
linux-hwe-5.15
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
bionic
dne
xenial
dne
trusty
dne
linux-hwe-5.19
plucky
dne
oracular
dne
noble
dne
jammy
ignored
focal
dne
bionic
dne
xenial
dne
trusty
dne
linux-hwe-6.2
plucky
dne
oracular
dne
noble
dne
jammy
ignored
focal
dne
bionic
dne
xenial
dne
trusty
dne
linux-hwe-6.5
plucky
dne
oracular
dne
noble
dne
jammy
ignored
focal
dne
bionic
dne
xenial
dne
trusty
dne
linux-hwe-6.8
plucky
dne
oracular
dne
noble
dne
jammy
needed
focal
dne
bionic
dne
xenial
dne
trusty
dne
linux-hwe-6.11
plucky
dne
oracular
dne
noble
ignored
jammy
dne
focal
dne
bionic
dne
xenial
dne
trusty
dne
linux-hwe-edge
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
ignored
xenial
ignored
trusty
dne
linux-lts-xenial
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
dne
xenial
dne
trusty
ignored
linux-kvm
plucky
dne
oracular
dne
noble
dne
jammy
needed
focal
ignored
bionic
ignored
xenial
ignored
trusty
dne
linux-allwinner-5.19
plucky
dne
oracular
dne
noble
dne
jammy
ignored
focal
dne
bionic
dne
xenial
dne
trusty
dne
linux-aws-5.0
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
ignored
xenial
dne
trusty
dne
linux-aws-5.3
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
ignored
xenial
dne
trusty
dne
linux-aws-5.4
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
ignored
xenial
dne
trusty
dne
linux-aws-5.8
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
bionic
dne
xenial
dne
trusty
dne
linux-aws-5.11
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
bionic
dne
xenial
dne
trusty
dne
linux-aws-5.13
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
bionic
dne
xenial
dne
trusty
dne
linux-aws-5.15
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
bionic
dne
xenial
dne
trusty
dne
linux-aws-5.19
plucky
dne
oracular
dne
noble
dne
jammy
ignored
focal
dne
bionic
dne
xenial
dne
trusty
dne
linux-aws-6.2
plucky
dne
oracular
dne
noble
dne
jammy
ignored
focal
dne
bionic
dne
xenial
dne
trusty
dne
linux-aws-6.5
plucky
dne
oracular
dne
noble
dne
jammy
ignored
focal
dne
bionic
dne
xenial
dne
trusty
dne
linux-aws-6.8
plucky
dne
oracular
dne
noble
dne
jammy
needed
focal
dne
bionic
dne
xenial
dne
trusty
dne
linux-aws-hwe
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
dne
xenial
ignored
trusty
dne
linux-azure
plucky
needed
oracular
ignored
noble
needed
jammy
needed
focal
ignored
bionic
ignored
xenial
ignored
trusty
ignored
linux-azure-4.15
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
ignored
xenial
dne
trusty
dne
linux-azure-5.3
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
ignored
xenial
dne
trusty
dne
linux-azure-5.4
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
ignored
xenial
dne
trusty
dne
linux-azure-5.8
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
bionic
dne
xenial
dne
trusty
dne
linux-azure-5.11
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
bionic
dne
xenial
dne
trusty
dne
linux-azure-5.13
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
bionic
dne
xenial
dne
trusty
dne
linux-azure-5.15
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
bionic
dne
xenial
dne
trusty
dne
linux-azure-5.19
plucky
dne
oracular
dne
noble
dne
jammy
ignored
focal
dne
bionic
dne
xenial
dne
trusty
dne
linux-azure-6.2
plucky
dne
oracular
dne
noble
dne
jammy
ignored
focal
dne
bionic
dne
xenial
dne
trusty
dne
linux-azure-6.5
plucky
dne
oracular
dne
noble
dne
jammy
ignored
focal
dne
bionic
dne
xenial
dne
trusty
dne
linux-azure-6.8
plucky
dne
oracular
dne
noble
dne
jammy
needed
focal
dne
bionic
dne
xenial
dne
trusty
dne
linux-azure-6.11
plucky
dne
oracular
dne
noble
ignored
jammy
dne
focal
dne
bionic
dne
xenial
dne
trusty
dne
linux-azure-fde
plucky
dne
oracular
dne
noble
dne
jammy
needed
focal
ignored
bionic
dne
xenial
dne
trusty
dne
linux-azure-fde-5.15
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
bionic
dne
xenial
dne
trusty
dne
linux-azure-fde-5.19
plucky
dne
oracular
dne
noble
dne
jammy
ignored
focal
dne
bionic
dne
xenial
dne
trusty
dne
linux-azure-fde-6.2
plucky
dne
oracular
dne
noble
dne
jammy
ignored
focal
dne
bionic
dne
xenial
dne
trusty
dne
linux-azure-nvidia
plucky
dne
oracular
dne
noble
needed
jammy
dne
focal
dne
bionic
dne
xenial
dne
trusty
dne
linux-bluefield
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
bionic
dne
xenial
dne
trusty
dne
linux-azure-edge
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
ignored
xenial
dne
trusty
dne
linux-fips
plucky
dne
oracular
dne
noble
dne
jammy
needed
focal
needed
bionic
needed
xenial
needed
trusty
dne
linux-aws-fips
plucky
dne
oracular
dne
noble
dne
jammy
needed
focal
needed
bionic
needed
xenial
dne
trusty
dne
linux-azure-fips
plucky
dne
oracular
dne
noble
dne
jammy
needed
focal
needed
bionic
needed
xenial
dne
trusty
dne
linux-gcp-fips
plucky
dne
oracular
dne
noble
dne
jammy
needed
focal
needed
bionic
needed
xenial
dne
trusty
dne
linux-gcp
plucky
needed
oracular
ignored
noble
needed
jammy
needed
focal
ignored
bionic
ignored
xenial
ignored
trusty
dne
linux-gcp-4.15
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
ignored
xenial
dne
trusty
dne
linux-gcp-5.3
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
ignored
xenial
dne
trusty
dne
linux-gcp-5.4
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
ignored
xenial
dne
trusty
dne
linux-gcp-5.8
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
bionic
dne
xenial
dne
trusty
dne
linux-gcp-5.11
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
bionic
dne
xenial
dne
trusty
dne
linux-gcp-5.13
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
bionic
dne
xenial
dne
trusty
dne
linux-gcp-5.15
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
bionic
dne
xenial
dne
trusty
dne
linux-gcp-5.19
plucky
dne
oracular
dne
noble
dne
jammy
ignored
focal
dne
bionic
dne
xenial
dne
trusty
dne
linux-gcp-6.2
plucky
dne
oracular
dne
noble
dne
jammy
ignored
focal
dne
bionic
dne
xenial
dne
trusty
dne
linux-gcp-6.5
plucky
dne
oracular
dne
noble
dne
jammy
ignored
focal
dne
bionic
dne
xenial
dne
trusty
dne
linux-gcp-6.8
plucky
dne
oracular
dne
noble
dne
jammy
needed
focal
dne
bionic
dne
xenial
dne
trusty
dne
linux-gcp-6.11
plucky
dne
oracular
dne
noble
ignored
jammy
dne
focal
dne
bionic
dne
xenial
dne
trusty
dne
linux-gke
plucky
dne
oracular
dne
noble
needed
jammy
needed
focal
ignored
bionic
dne
xenial
ignored
trusty
dne
linux-gke-4.15
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
ignored
xenial
dne
trusty
dne
linux-gke-5.4
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
ignored
xenial
dne
trusty
dne
linux-gke-5.15
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
bionic
dne
xenial
dne
trusty
dne
linux-gkeop
plucky
dne
oracular
dne
noble
needed
jammy
needed
focal
ignored
bionic
dne
xenial
dne
trusty
dne
linux-gkeop-5.4
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
ignored
xenial
dne
trusty
dne
linux-gkeop-5.15
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
bionic
dne
xenial
dne
trusty
dne
linux-ibm
plucky
dne
oracular
dne
noble
needed
jammy
needed
focal
ignored
bionic
dne
xenial
dne
trusty
dne
linux-ibm-5.4
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
ignored
xenial
dne
trusty
dne
linux-ibm-5.15
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
bionic
dne
xenial
dne
trusty
dne
linux-intel-5.13
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
bionic
dne
xenial
dne
trusty
dne
linux-intel-iotg
plucky
dne
oracular
dne
noble
dne
jammy
needed
focal
dne
bionic
dne
xenial
dne
trusty
dne
linux-intel-iotg-5.15
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
bionic
dne
xenial
dne
trusty
dne
linux-iot
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
bionic
dne
xenial
dne
trusty
dne
linux-intel-iot-realtime
plucky
dne
oracular
dne
noble
dne
jammy
needed
focal
dne
bionic
dne
xenial
dne
trusty
dne
linux-lowlatency
plucky
dne
oracular
ignored
noble
needed
jammy
needed
focal
dne
bionic
dne
xenial
dne
trusty
dne
linux-lowlatency-hwe-5.15
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
bionic
dne
xenial
dne
trusty
dne
linux-lowlatency-hwe-5.19
plucky
dne
oracular
dne
noble
dne
jammy
ignored
focal
dne
bionic
dne
xenial
dne
trusty
dne
linux-lowlatency-hwe-6.2
plucky
dne
oracular
dne
noble
dne
jammy
ignored
focal
dne
bionic
dne
xenial
dne
trusty
dne
linux-lowlatency-hwe-6.5
plucky
dne
oracular
dne
noble
dne
jammy
ignored
focal
dne
bionic
dne
xenial
dne
trusty
dne
linux-lowlatency-hwe-6.8
plucky
dne
oracular
dne
noble
dne
jammy
needed
focal
dne
bionic
dne
xenial
dne
trusty
dne
linux-lowlatency-hwe-6.11
plucky
dne
oracular
dne
noble
ignored
jammy
dne
focal
dne
bionic
dne
xenial
dne
trusty
dne
linux-nvidia
plucky
dne
oracular
dne
noble
needed
jammy
needed
focal
dne
bionic
dne
xenial
dne
trusty
dne
linux-nvidia-6.2
plucky
dne
oracular
dne
noble
dne
jammy
ignored
focal
dne
bionic
dne
xenial
dne
trusty
dne
linux-nvidia-6.5
plucky
dne
oracular
dne
noble
dne
jammy
ignored
focal
dne
bionic
dne
xenial
dne
trusty
dne
linux-nvidia-6.8
plucky
dne
oracular
dne
noble
dne
jammy
needed
focal
dne
bionic
dne
xenial
dne
trusty
dne
linux-nvidia-lowlatency
plucky
dne
oracular
dne
noble
needed
jammy
dne
focal
dne
bionic
dne
xenial
dne
trusty
dne
linux-nvidia-tegra
plucky
dne
oracular
dne
noble
needed
jammy
needed
focal
dne
bionic
dne
xenial
dne
trusty
dne
linux-nvidia-tegra-5.15
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
bionic
dne
xenial
dne
trusty
dne
linux-nvidia-tegra-igx
plucky
dne
oracular
dne
noble
dne
jammy
needed
focal
dne
bionic
dne
xenial
dne
trusty
dne
linux-oracle-5.0
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
ignored
xenial
dne
trusty
dne
linux-oracle-5.3
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
ignored
xenial
dne
trusty
dne
linux-oracle-5.4
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
ignored
xenial
dne
trusty
dne
linux-oracle-5.8
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
bionic
dne
xenial
dne
trusty
dne
linux-oracle-5.11
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
bionic
dne
xenial
dne
trusty
dne
linux-oracle-5.13
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
bionic
dne
xenial
dne
trusty
dne
linux-oracle-5.15
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
bionic
dne
xenial
dne
trusty
dne
linux-oracle-6.5
plucky
dne
oracular
dne
noble
dne
jammy
ignored
focal
dne
bionic
dne
xenial
dne
trusty
dne
linux-oracle-6.8
plucky
dne
oracular
dne
noble
dne
jammy
needed
focal
dne
bionic
dne
xenial
dne
trusty
dne
linux-oem
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
ignored
xenial
ignored
trusty
dne
linux-oem-5.6
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
bionic
dne
xenial
dne
trusty
dne
linux-oem-5.10
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
bionic
dne
xenial
dne
trusty
dne
linux-oem-5.13
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
bionic
dne
xenial
dne
trusty
dne
linux-oem-5.14
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
bionic
dne
xenial
dne
trusty
dne
linux-oem-5.17
plucky
dne
oracular
dne
noble
dne
jammy
ignored
focal
dne
bionic
dne
xenial
dne
trusty
dne
linux-oem-6.0
plucky
dne
oracular
dne
noble
dne
jammy
ignored
focal
dne
bionic
dne
xenial
dne
trusty
dne
linux-oem-6.1
plucky
dne
oracular
dne
noble
dne
jammy
ignored
focal
dne
bionic
dne
xenial
dne
trusty
dne
linux-oem-6.5
plucky
dne
oracular
dne
noble
dne
jammy
ignored
focal
dne
bionic
dne
xenial
dne
trusty
dne
linux-oem-6.8
plucky
dne
oracular
dne
noble
needed
jammy
dne
focal
dne
bionic
dne
xenial
dne
trusty
dne
linux-oem-6.11
plucky
dne
oracular
dne
noble
needed
jammy
dne
focal
dne
bionic
dne
xenial
dne
trusty
dne
linux-oem-6.14
plucky
dne
oracular
dne
noble
needed
jammy
dne
focal
dne
bionic
dne
xenial
dne
trusty
dne
linux-raspi2
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
bionic
ignored
xenial
ignored
trusty
dne
linux-raspi-5.4
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
ignored
xenial
dne
trusty
dne
linux-raspi-realtime
plucky
dne
oracular
dne
noble
needed
jammy
dne
focal
dne
bionic
dne
xenial
dne
trusty
dne
linux-riscv
plucky
needed
oracular
ignored
noble
ignored
jammy
ignored
focal
ignored
bionic
dne
xenial
dne
trusty
dne
linux-riscv-5.8
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
bionic
dne
xenial
dne
trusty
dne
linux-riscv-5.11
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
bionic
dne
xenial
dne
trusty
dne
linux-riscv-5.15
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
bionic
dne
xenial
dne
trusty
dne
linux-riscv-5.19
plucky
dne
oracular
dne
noble
dne
jammy
ignored
focal
dne
bionic
dne
xenial
dne
trusty
dne
linux-riscv-6.5
plucky
dne
oracular
dne
noble
dne
jammy
ignored
focal
dne
bionic
dne
xenial
dne
trusty
dne
linux-riscv-6.8
plucky
dne
oracular
dne
noble
dne
jammy
needed
focal
dne
bionic
dne
xenial
dne
trusty
dne
linux-starfive-5.19
plucky
dne
oracular
dne
noble
dne
jammy
ignored
focal
dne
bionic
dne
xenial
dne
trusty
dne
linux-starfive-6.2
plucky
dne
oracular
dne
noble
dne
jammy
ignored
focal
dne
bionic
dne
xenial
dne
trusty
dne
linux-starfive-6.5
plucky
dne
oracular
dne
noble
dne
jammy
ignored
focal
dne
bionic
dne
xenial
dne
trusty
dne
linux-xilinx-zynqmp
plucky
dne
oracular
dne
noble
dne
jammy
needed
focal
ignored
bionic
dne
xenial
dne
trusty
dne
linux
plucky
needed
oracular
ignored
noble
needed
jammy
needed
focal
ignored
bionic
ignored
xenial
ignored
trusty
ignored
linux-aws
plucky
needed
oracular
ignored
noble
needed
jammy
needed
focal
ignored
bionic
ignored
xenial
ignored
trusty
ignored
linux-oracle
plucky
needed
oracular
ignored
noble
needed
jammy
needed
focal
ignored
bionic
ignored
xenial
ignored
trusty
dne
linux-raspi
plucky
needed
oracular
ignored
noble
needed
jammy
needed
focal
ignored
bionic
dne
xenial
dne
trusty
dne
linux-realtime
plucky
needed
oracular
ignored
noble
needed
jammy
needed
focal
dne
bionic
dne
xenial
dne
trusty
dne
linux-intel
plucky
dne
oracular
dne
noble
needed
jammy
dne
focal
dne
bionic
dne
xenial
dne
trusty
dne
linux-riscv-6.14
plucky
dne
oracular
dne
noble
needed
jammy
dne
focal
dne
bionic
dne
xenial
dne
trusty
dne
linux-ibm-6.8
plucky
dne
oracular
dne
noble
dne
jammy
needed
focal
dne
bionic
dne
xenial
dne
trusty
dne
linux-aws-6.14
plucky
dne
noble
needed
jammy
dne
focal
dne
bionic
dne
xenial
dne
trusty
dne
linux-gcp-6.14
plucky
dne
noble
needed
jammy
dne
focal
dne
bionic
dne
xenial
dne
trusty
dne
linux-hwe-6.14
plucky
dne
noble
needed
jammy
dne
focal
dne
bionic
dne
xenial
dne
trusty
dne
linux-oracle-6.14
plucky
dne
noble
needed
jammy
dne
focal
dne
bionic
dne
xenial
dne
trusty
dne