CVE-2025-39961
Description
A race condition flaw was found in the Linux kernel AMD IOMMU page table code when increasing the page table level to support larger IOVA ranges. An unlocked read of the page table root/mode could observe mixed state during an update, causing unmap failures and device mapping errors.
A local user could use this flaw to trigger I/O errors and system instability, resulting in a denial of service.
Statement
During address-space growth (increase_address_space()), the AMD IOMMU driver updated the root pointer and mode without readers synchronizing on a sequence counter. Concurrent fetch_pte() in unmap paths could see the new root with the old mode and return NULL, leading upper layers to fail unmaps and warn. The fix adds a seqcount around updates to allow lockless, consistent readers.
Mitigation
To mitigate this issue, prevent module amd_iommu from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.3 | 4.7 | 8.8 |
| Attack Vector | Local | Local | Local |
| Attack Complexity | High | High | Low |
| Privileges Required | Low | Low | Low |
| User Interaction | None | None | None |
| Scope | Unchanged | Unchanged | Changed |
| Confidentiality | None | None | High |
| Integrity Impact | Low | None | High |
| Availability Impact | High | High | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
NVD: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
