CVE-2025-71089

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

iommu: disable SVA when CONFIG_X86 is set

Patch series "Fix stale IOTLB entries for kernel address space", v7.

This proposes a fix for a security vulnerability related to IOMMU Shared

Virtual Addressing (SVA). In an SVA context, an IOMMU can cache kernel

page table entries. When a kernel page table page is freed and

reallocated for another purpose, the IOMMU might still hold stale,

incorrect entries. This can be exploited to cause a use-after-free or

write-after-free condition, potentially leading to privilege escalation or

data corruption.

This solution introduces a deferred freeing mechanism for kernel page

table pages, which provides a safe window to notify the IOMMU to

invalidate its caches before the page is reused.

This patch (of 8):

In the IOMMU Shared Virtual Addressing (SVA) context, the IOMMU hardware

shares and walks the CPU's page tables. The x86 architecture maps the

kernel's virtual address spa

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References