CVE-2025-40058

Vulnerability

Details The Intel VT-d IOMMU driver in the Linux kernel incorrectly allowed dirty page tracking to be enabled even when the IOMMU page walk is incoherent. Dirty page tracking relies on the IOMMU atomically updating dirty bits in paging-structure entries, which requires memory coherency between the IOMMU and CPU. The VT-d specification (Section 3.10) states that atomic updates on non-snooped entries result in a non-recoverable fault [1].

Exploitation

An attacker who can influence IOMMU configuration or trigger DMA operations that use dirty tracking could cause the IOMMU to encounter a non-recoverable fault. This requires local access or the ability to manipulate device drivers that interact with the IOMMU. No special privileges are needed beyond the ability to trigger such operations.

Impact

Successful exploitation leads to a non-recoverable fault, likely resulting in a system crash or hang, i.e., a denial of service condition.

Mitigation

The fix is included in Linux kernel commit 8d096ce0e87b, which ensures that SSADS (Scalable Mode Page Walk Coherency) is only marked as supported when both ecap_slads and ecap_smpwc are present, preventing dirty tracking on incoherent page walks [1]. Users should apply the latest kernel updates.