Description

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix ineffective error check in nested domain allocation amd_iommu_pdom_id_alloc() returns an int: a domain ID on success, or the negative errno from ida_alloc_range() when the ID space is exhausted or memory is short. amd_iommu_alloc_domain_nested() stores that return value in gdom_info->hdom_id, which is a u32, and only then tests it: gdom_info->hdom_id = amd_iommu_pdom_id_alloc(); if (gdom_info->hdom_id <= 0) { The assignment discards the sign, so -ENOSPC becomes 0xffffffe4 and the test never fires. The nested domain is then set up with a host domain ID that was never allocated, instead of the allocation failing with -ENOSPC. Keep the value in an int, test it there, and store it only once it is known to be valid, which is what the other amd_iommu_pdom_id_alloc() callers already do.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-25T11:17:28.430Z",
  "pubdate": "2026-09-25T11:17:28.430Z",
  "executiveSummary": "This vulnerability is an integer type confusion flaw within the Linux kernel AMD IOMMU driver, specifically affecting the nested domain allocation logic. The vulnerability type is an improper error handling condition arising from sign-bit truncation during assignment.\nThe issue exists in amd_iommu_alloc_domain_nested(), where the return value of amd_iommu_pdom_id_alloc() is assigned to an unsigned 32-bit integer (u32) before validation. Because amd_iommu_pdom_id_alloc() returns a signed integer to indicate error codes, the truncation causes negative errno values to be interpreted as large positive integers.\nThe impact is significant as it allows the kernel to proceed with a domain configuration using an unallocated host domain ID. This failure to handle exhaustion or memory allocation errors gracefully can lead to system instability, kernel panics, or potential security boundary violations within the IOMMU translation infrastructure.\nExploitation requires the attacker to be in a position to trigger high-pressure scenarios for domain ID exhaustion, such as repeatedly creating and destroying nested domains. No specific network exposure is required, as the flaw is triggered via local system calls affecting the IOMMU driver subsystems.",
  "technicalDetails": "The root cause is a logic error in the function amd_iommu_alloc_domain_nested() within the Linux kernel's AMD IOMMU driver. The function calls amd_iommu_pdom_id_alloc() to retrieve a domain ID. This helper function is designed to return an integer (int), which represents a valid domain ID upon success or a negative error code (e.g., -ENOSPC) upon failure.\nThe vulnerability manifests due to the insecure assignment of the return value into the structure member gdom_info->hdom_id, which is defined as a u32 (unsigned 32-bit integer). In C, assigning a negative signed integer to an unsigned type results in integer representation wrap-around; for instance, -ENOSPC (which is -28) becomes 0xffffffe4 in hexadecimal, which is interpreted by the kernel as the positive integer 4,294,967,268.\nThe subsequent conditional check 'if (gdom_info->hdom_id <= 0)' performs a comparison against an unsigned variable. Because the value is now a very large positive number, the condition evaluates to false, failing to catch the underlying error state. This bypassed check causes the kernel to proceed with the domain initialization process using an unallocated and invalid host domain ID.\nAttack flow: An attacker capable of invoking IOMMU-related system calls (typically requiring root or specific device access privileges) can initiate a sequence of nested domain allocations. By exhausting the available domain ID space or forcing memory allocation failures, the attacker triggers the error path in amd_iommu_pdom_id_alloc(). Because the error check is rendered ineffective by the truncation, the system enters an inconsistent state. The IOMMU hardware may then be configured with malformed or collision-prone identifiers, potentially leading to unauthorized memory access across device domains or kernel panics when the IOMMU hardware attempts to reference the bogus ID during DMA mapping operations.\nThe vulnerable component is the AMD IOMMU driver, specifically the logic managing nested domain lifecycle management. This flaw affects systems utilizing AMD IOMMU hardware features where nested domains are active. The vulnerability is restricted to the kernel space, and exploitation relies on the inability of the driver to properly validate the returned state of the ID allocator before proceeding with hardware programming."
}