Linux Kernel IOMMU Memory Leak Vulnerability in Device Removal Process

Vulnerability

A memory leak vulnerability has been identified in the Linux kernel's IOMMU (Input-Output Memory Management Unit) handling. The issue arises in the 'iopf_queue_remove_device()' function, which is responsible for removing a device from the IOMMU queue when the Process Interrupts (PRI) are disabled. While the function correctly responds to outstanding IOPFs (IOMMU Page Faults) by invalidating the response and detaching the device from the queue, it fails to release the associated group structure that tracks pending IOPFs awaiting a response. This oversight can lead to a memory leak if 'iopf_queue_remove_device()' is called while there are outstanding IOPFs. The vulnerability has been addressed by modifying the function to call 'iopf_free_group()' after responding to the hardware, ensuring that the group structure is properly released.

Impact

The vulnerability can lead to a memory leak, causing increased memory usage and potentially degrading system performance over time.

Added: Jun 9, 2025, 7:46 PM
Updated: Jun 9, 2025, 7:46 PM

Vulnerability Rating

Custom Algorithm
spread
9.0
impact
2.5
exploitability
4.0
remediation
0.0
relevance
0.0
threat
3.2
urgency
2.9
incentive
1.7

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.