CVE-2026-98003

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

iommu/amd: Do not reallocate GA log buffers on resume

Commit c5e1a1eb9279 ("iommu/amd: Simplify and Consolidate Virtual APIC

(AVIC) Enablement") moved the GA log allocation from iommu_init_pci()

to enable_iommus_vapic(), which is called on every resume.

iommu_init_ga_log() assigns iommu->ga_log and iommu->ga_log_tail

unconditionally. Each resume therefore replaces the boot-time pointers

and leaks both old allocations. The function also uses GFP_KERNEL from a

syscore resume callback, where interrupts are disabled and the non-boot

CPUs are offline.

Return early if both buffers are already allocated. Clear the pointers

in free_ga_log() so a partial allocation failure cannot leave ga_log

dangling.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References