CVE-2026-98002

A moderate severity flaw was found in the Linux kernel's AMD IOMMU driver. When a nested translation domain is allocated, amd_iommu_pdom_id_alloc() returns either a domain ID or a negative errno such as -ENOSPC when the domain ID space is exhausted or memory is short. That signed return value is stored into the unsigned 32-bit hdom_id field before being tested, so the sign is discarded, the error check never fires, and the nested domain is configured with a host domain ID that was never allocated instead of the allocation failing cleanly. A local user who can trigger nested domain allocation through the IOMMUFD interface can exploit this flaw to cause a denial of service or system instability when domain identifiers or memory resources are exhausted.

The vulnerable code, introduced with the gDomID-to-hDomID mapping support, is present only in Red Hat Enterprise Linux 10 (rhel-10.3 and rhel-10.4) and Red Hat In-Vehicle OS 2 (kernel and kernel-ivos-qualcomm components). Other Red Hat Enterprise Linux streams and the OpenShift Container Platform RHEL CoreOS images do not contain the vulnerable code and are therefore not affected.

The fix for the affected streams is currently deferred: given the moderate, availability-only impact and the narrow preconditions required to reach the flawed code path, it will be addressed in a future update rather than an immediate erratum. Until a fix is delivered, the residual risk is limited to a local user causing denial of service or system instability under IOMMU domain ID or memory exhaustion conditions.

Red Hat rates this flaw as Moderate (CVSS 3.1 base score 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), lower than the Important rating (7.8) in the upstream CVE record. The difference reflects Red Hat's assessment that exploitation requires local access and resource exhaustion preconditions, and that the impact is limited to availability with no demonstrated confidentiality or integrity impact.