CVE-2025-39958

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

iommu/s390: Make attach succeed when the device was surprise removed

When a PCI device is removed with surprise hotplug, there may still be

attempts to attach the device to the default domain as part of tear down

via (__iommu_release_dma_ownership()), or because the removal happens

during probe (__iommu_probe_device()). In both cases zpci_register_ioat()

fails with a cc value indicating that the device handle is invalid. This

is because the device is no longer part of the instance as far as the

hypervisor is concerned.

Currently this leads to an error return and s390_iommu_attach_device()

fails. This triggers the WARN_ON() in __iommu_group_set_domain_nofail()

because attaching to the default domain must never fail.

With the device fenced by the hypervisor no DMAs to or from memory are

possible and the IOMMU translations have no effect. Proceed as if the

registration was successful and let the hotplug event handling

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References