CVE-2025-40155

Root

Cause

In the Linux kernel's IOMMU VT-d debugfs interface, when dumping the page table in legacy mode, fails to check the Translation Type (TT) field before using the Second-level Stage Page Table Pointer (SSPTPTR). According to the VT-d specification, SSPTPTR is only valid when TT is 00b or 01b; otherwise it may be uninitialized or contain stale data. The code unconditionally walks the page table using SSPTPTR, leading to a general protection fault (oops) when TT is not 00b or 01b [1].

Exploitation

The vulnerability is triggered by reading the debugfs file domain_translation_struct (or similar) for a device that uses legacy mode with an invalid TT value. No special privileges beyond local access to debugfs are required; a local user with read access to the debugfs file can cause the kernel to crash. The crash trace shows a pgtable_walk_level function dereferencing a non-canon-canonical address 0xf00087d3f000f000 [1].

Impact

An attacker with local access can trigger a kernel oops (general protection fault), resulting in a denial of service (system crash or hang). The vulnerability does not appear to allow privilege escalation or arbitrary code execution, as the fault occurs during a read operation and the invalid address is not attacker-controlled in a way that would permit controlled memory corruption [1].

Mitigation

The fix adds a check for TT before walking the page table; if TT is not 00b or 01b, the walk is skipped. The patch has been applied to the Linux kernel stable tree [1]. Users should update to a kernel version containing the commit d8cf7b59c49f or later. No workaround is available other than restricting access to debugfs (or disabling) the debugfs interface.