CVE-2025-39961

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

iommu/amd/pgtbl: Fix possible race while increase page table level

The AMD IOMMU host page table implementation supports dynamic page table levels

(up to 6 levels), starting with a 3-level configuration that expands based on

IOVA address. The kernel maintains a root pointer and current page table level

to enable proper page table walks in alloc_pte()/fetch_pte() operations.

The IOMMU IOVA allocator initially starts with 32-bit address and onces its

exhuasted it switches to 64-bit address (max address is determined based

on IOMMU and device DMA capability). To support larger IOVA, AMD IOMMU

driver increases page table level.

But in unmap path (iommu_v1_unmap_pages()), fetch_pte() reads

pgtable->[root/mode] without lock. So its possible that in exteme corner case,

when increase_address_space() is updating pgtable->[root/mode], fetch_pte()

reads wrong page table level (pgtable->mode). It does compare the value with

le

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References