linux-cve-announce - CVE-2025-40058: iommu/vt-d: Disallow dirty tracking if incoherent page walk

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025102815-CVE-2025-40058-0eba@gregkh>
Date: Tue, 28 Oct 2025 12:48:35 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2025-40058: iommu/vt-d: Disallow dirty tracking if incoherent page walk

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

iommu/vt-d: Disallow dirty tracking if incoherent page walk

Dirty page tracking relies on the IOMMU atomically updating the dirty bit
in the paging-structure entry. For this operation to succeed, the paging-
structure memory must be coherent between the IOMMU and the CPU. In
another word, if the iommu page walk is incoherent, dirty page tracking
doesn't work.

The Intel VT-d specification, Section 3.10 "Snoop Behavior" states:

"Remapping hardware encountering the need to atomically update A/EA/D bits
 in a paging-structure entry that is not snooped will result in a non-
 recoverable fault."

To prevent an IOMMU from being incorrectly configured for dirty page
tracking when it is operating in an incoherent mode, mark SSADS as
supported only when both ecap_slads and ecap_smpwc are supported.

The Linux kernel CVE team has assigned CVE-2025-40058 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.7 with commit f35f22cc760eb2c7034bf53251399685d611e03f and fixed in 6.12.53 with commit ebe16d245a00626bb87163862a1b07daf5475a3e
	Issue introduced in 6.7 with commit f35f22cc760eb2c7034bf53251399685d611e03f and fixed in 6.17.3 with commit 8d096ce0e87bdc361f0b25d7943543bc53aa0b9e
	Issue introduced in 6.7 with commit f35f22cc760eb2c7034bf53251399685d611e03f and fixed in 6.18-rc1 with commit 57f55048e564dedd8a4546d018e29d6bbfff0a7e

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-40058
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/iommu/intel/iommu.h


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/ebe16d245a00626bb87163862a1b07daf5475a3e
	https://git.kernel.org/stable/c/8d096ce0e87bdc361f0b25d7943543bc53aa0b9e
	https://git.kernel.org/stable/c/57f55048e564dedd8a4546d018e29d6bbfff0a7e