{
  "threat_severity" : "Moderate",
  "public_date" : "2026-02-14T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: Linux kernel: Memory Corruption and Kernel Crashes via IOMMU SVA coherency issue",
    "id" : "2439859",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2439859"
  },
  "cvss3" : {
    "cvss3_base_score" : "6.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H",
    "status" : "draft"
  },
  "cwe" : "CWE-909",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\niommu/sva: invalidate stale IOTLB entries for kernel address space\nIntroduce a new IOMMU interface to flush IOTLB paging cache entries for\nthe CPU kernel address space.  This interface is invoked from the x86\narchitecture code that manages combined user and kernel page tables,\nspecifically before any kernel page table page is freed and reused.\nThis addresses the main issue with vfree() which is a common occurrence\nand can be triggered by unprivileged users.  While this resolves the\nprimary problem, it doesn't address some extremely rare case related to\nmemory unplug of memory that was present as reserved memory at boot, which\ncannot be triggered by unprivileged users.  The discussion can be found at\nthe link below.\nEnable SVA on x86 architecture since the IOMMU can now receive\nnotification to flush the paging cache before freeing the CPU kernel page\ntable pages.", "A flaw was found in the Linux kernel. This vulnerability, an IOMMU SVA (Input/Output Memory Management Unit Shared Virtual Addressing) coherency issue, affects x86 systems. An unprivileged local user can trigger this by causing the kernel to free and reuse page table memory, while the IOMMU retains stale cached translations. This can lead to memory corruption, resulting in kernel crashes and potentially allowing an attacker to alter kernel memory contents." ],
  "statement" : "An IOMMU SVA coherency issue exists on x86 when the IOMMU keeps stale IOTLB paging cache entries for kernel address space mappings while the kernel frees and reuses kernel page table pages. Without an architectural notification path the IOMMU may continue to use cached translations that reference freed page table memory. Since vfree and kernel page table reclamation are common this can be triggered as part of normal kernel activity once SVA is enabled and at least one mm is bound to a device through iommu_sva_bind_device. Stale IOTLB entries can lead to device DMA using outdated translations. Depending on the device and workload this can result in memory corruption of reused kernel page table pages. That can manifest as kernel crashes and can potentially be abused to alter kernel memory contents.",
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2025-71202\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-71202\nhttps://lore.kernel.org/linux-cve-announce/2026021414-CVE-2025-71202-4c01@gregkh/T" ],
  "name" : "CVE-2025-71202",
  "csaw" : false
}