Linux Kernel IOMMUFD Double Attachment Vulnerability in HWPT List

A vulnerability in the Linux kernel's IOMMUFD subsystem allows for the same hardware page table (HWPT) to be added twice to the I/O address space's hardware page table list. This issue arises because the HWPT is only supposed to be added once, during its creation. The flaw, a remnant of previous code rework, can lead to corruption of the linked list under certain conditions. The vulnerability specifically impacts HWPT attachments, a scenario not currently covered by the test suite. Exploitation would require creating a valid struct device with a non-system IOMMU driver, which is not possible until the bus is removed from the IOMMU code.

Impact

Adding the same HWPT to the list twice can corrupt the linked list, potentially leading to undefined behavior or crashes.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been addressed.