CVE-2025-39961

{"id": "CVE-2025-39961", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-39961", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:55:10.295299Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.0}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.0}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "754265bcab78a9014f0f99cd35e0d610fcd7dfa7", "lessThan": "075abf0b1a958acfbea2435003d228e738e90346", "versionType": "git"}, {"status": "affected", "version": "754265bcab78a9014f0f99cd35e0d610fcd7dfa7", "lessThan": "cd92c8ab336c3a633d46e6f35ebcd3509ae7db3b", "versionType": "git"}, {"status": "affected", "version": "754265bcab78a9014f0f99cd35e0d610fcd7dfa7", "lessThan": "7d462bdecb7d9c32934dab44aaeb7ea7d73a27a2", "versionType": "git"}, {"status": "affected", "version": "754265bcab78a9014f0f99cd35e0d610fcd7dfa7", "lessThan": "1e56310b40fd2e7e0b9493da9ff488af145bdd0c", "versionType": "git"}, {"status": "affected", "version": "6fb92f18555a7b8e085267d513612dc0ff9a5360", "versionType": "git"}, {"status": "affected", "version": "b15bf74405faa1a65025eb8a6eb337e140e5250a", "versionType": "git"}, {"status": "affected", "version": "0d50f7b1e8c80a8c20db5049e269468c059b0378", "versionType": "git"}, {"status": "affected", "version": "785ca708a908b9c596ede852470ba28b8dc3e40b", "versionType": "git"}, {"status": "affected", "version": "4.9.194", "lessThan": "4.10", "versionType": "semver"}, {"status": "affected", "version": "4.14.146", "lessThan": "4.15", "versionType": "semver"}, {"status": "affected", "version": "4.19.75", "lessThan": "4.20", "versionType": "semver"}, {"status": "affected", "version": "5.2.17", "lessThan": "5.3", "versionType": "semver"}], "programFiles": ["drivers/iommu/amd/amd_iommu_types.h", "drivers/iommu/amd/io_pgtable.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.3"}, {"status": "unaffected", "version": "0", "lessThan": "5.3", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.108", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.49", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.16.9", "versionType": "semver", "lessThanOrEqual": "6.16.*"}, {"status": "unaffected", "version": "6.17", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/iommu/amd/amd_iommu_types.h", "drivers/iommu/amd/io_pgtable.c"], "defaultStatus": "affected"}]}], "published": "2025-10-09T13:15:32.250", "references": [{"url": "https://git.kernel.org/stable/c/075abf0b1a958acfbea2435003d228e738e90346", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/1e56310b40fd2e7e0b9493da9ff488af145bdd0c", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/7d462bdecb7d9c32934dab44aaeb7ea7d73a27a2", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/cd92c8ab336c3a633d46e6f35ebcd3509ae7db3b", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-362"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/amd/pgtbl: Fix possible race while increase page table level\n\nThe AMD IOMMU host page table implementation supports dynamic page table levels\n(up to 6 levels), starting with a 3-level configuration that expands based on\nIOVA address. The kernel maintains a root pointer and current page table level\nto enable proper page table walks in alloc_pte()/fetch_pte() operations.\n\nThe IOMMU IOVA allocator initially starts with 32-bit address and onces its\nexhuasted it switches to 64-bit address (max address is determined based\non IOMMU and device DMA capability). To support larger IOVA, AMD IOMMU\ndriver increases page table level.\n\nBut in unmap path (iommu_v1_unmap_pages()), fetch_pte() reads\npgtable->[root/mode] without lock. So its possible that in exteme corner case,\nwhen increase_address_space() is updating pgtable->[root/mode], fetch_pte()\nreads wrong page table level (pgtable->mode). It does compare the value with\nlevel encoded in page table and returns NULL. This will result is\niommu_unmap ops to fail and upper layer may retry/log WARN_ON.\n\nCPU 0 CPU 1\n------ ------\nmap pages unmap pages\nalloc_pte() -> increase_address_space() iommu_v1_unmap_pages() -> fetch_pte()\n pgtable->root = pte (new root value)\n READ pgtable->[mode/root]\n\t\t\t\t\t Reads new root, old mode\n Updates mode (pgtable->mode += 1)\n\nSince Page table level updates are infrequent and already synchronized with a\nspinlock, implement seqcount to enable lock-free read operations on the read path."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\niommu/amd/pgtbl: Corrige una posible condici\u00f3n de carrera al aumentar el nivel de la tabla de p\u00e1ginas\n\nLa implementaci\u00f3n de la tabla de p\u00e1ginas de host de AMD IOMMU soporta niveles de tabla de p\u00e1ginas din\u00e1micos (hasta 6 niveles), comenzando con una configuraci\u00f3n de 3 niveles que se expande bas\u00e1ndose en la direcci\u00f3n IOVA. El kernel mantiene un puntero ra\u00edz y el nivel actual de la tabla de p\u00e1ginas para permitir recorridos adecuados de la tabla de p\u00e1ginas en las operaciones alloc_pte()/fetch_pte().\n\nEl asignador IOVA de IOMMU inicialmente comienza con una direcci\u00f3n de 32 bits y una vez que se agota, cambia a una direcci\u00f3n de 64 bits (la direcci\u00f3n m\u00e1xima se determina bas\u00e1ndose en la capacidad DMA del IOMMU y del dispositivo). Para soportar IOVA m\u00e1s grandes, el controlador AMD IOMMU aumenta el nivel de la tabla de p\u00e1ginas.\n\nPero en la ruta de desmapeo (iommu_v1_unmap_pages()), fetch_pte() lee pgtable->[root/mode] sin bloqueo. As\u00ed que es posible que en un caso extremo, cuando increase_address_space() est\u00e1 actualizando pgtable->[root/mode], fetch_pte() lea un nivel de tabla de p\u00e1ginas incorrecto (pgtable->mode). Compara el valor con el nivel codificado en la tabla de p\u00e1ginas y devuelve NULL. Esto resultar\u00e1 en que las operaciones iommu_unmap fallen y la capa superior puede reintentar/registrar WARN_ON.\n\nCPU 0 CPU 1\n------ ------\nmapear p\u00e1ginas desmapear p\u00e1ginas\nalloc_pte() -> increase_address_space() iommu_v1_unmap_pages() -> fetch_pte()\n pgtable->root = pte (nuevo valor ra\u00edz)\n LEER pgtable->[mode/root]\n\t\t\t\t\t Lee nueva ra\u00edz, modo antiguo\n Actualiza el modo (pgtable->mode += 1)\n\nDado que las actualizaciones del nivel de la tabla de p\u00e1ginas son poco frecuentes y ya est\u00e1n sincronizadas con un spinlock, se implementa seqcount para habilitar operaciones de lectura sin bloqueo en la ruta de lectura."}], "lastModified": "2026-10-19T21:10:00.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2572FA5E-845E-4DF3-9D9C-8918ECC777C8", "versionEndExcluding": "4.10", "versionStartIncluding": "4.9.194"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F1F3489C-0F08-4C44-9AFD-D45E286F51D3", "versionEndExcluding": "4.15", "versionStartIncluding": "4.14.146"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5EC25515-A753-47F9-823B-4483BE60F328", "versionEndExcluding": "4.20", "versionStartIncluding": "4.19.75"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C42AB381-30AB-4C50-8C95-A4BFAF431AFB", "versionEndExcluding": "5.3", "versionStartIncluding": "5.2.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "983311BA-7332-42E8-9C1F-71C82FC23C03", "versionEndExcluding": "6.6.108", "versionStartIncluding": "5.3.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CAA033E9-A2C5-4976-A83E-9804D8FB827F", "versionEndExcluding": "6.12.49", "versionStartIncluding": "6.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "638DD910-1189-4F5E-98BF-2D436B695112", "versionEndExcluding": "6.16.9", "versionStartIncluding": "6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.3:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D036D76E-AC69-4382-B4C1-8EDA1ABB2941"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.3:rc8:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "999345BA-F820-40B9-A711-32CA9265C289"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "327D22EF-390B-454C-BD31-2ED23C998A1C"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C730CD9A-D969-4A8E-9522-162AAF7C0EE9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "39982C4B-716E-4B2F-8196-FA301F47807D"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "340BEEA9-D70D-4290-B502-FBB1032353B1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "47E4C5C0-079F-4838-971B-8C503D48FCC2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5A4516A6-C12E-42A4-8C0E-68AEF3264504"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}