HIGH Introduced in 7.0
amd-iommu NestedDomain Bypass
CVE-2026-98002
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
KernelScan AI7.5HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix ineffective error check in nested domain allocation amd_iommu_pdom_id_alloc() returns an int: a domain ID on success, or the negative errno from ida_alloc_range() when the ID space is exhausted or memory is short. amd_iommu_alloc_domain_nested() stores that return value in gdom_info->hdom_id, which is a u32, and only then tests it: gdom_info->hdom_id = amd_iommu_pdom_id_alloc(); if (gdom_info->hdom_id <= 0) { The assignment discards the sign, so -ENOSPC becomes 0xffffffe4 and the test never fires. The nested domain is then set up with a host domain ID that was never allocated, instead of the allocation failing with -ENOSPC. Keep the value in an int, test it there, and store it only once it is known to be valid, which is what the other amd_iommu_pdom_id_alloc() callers already do.
02KernelScan AI Analysis
Risk summary
A sign-conversion bug in the AMD IOMMU nested domain allocator silently ignores allocation failures, allowing a nested domain to be created with an invalid host domain ID. On systems with AMD IOMMU hardware and nested translation enabled, a local attacker who can exhaust the domain ID space may cause DMA isolation to break, giving a passthrough device access to arbitrary host memory.
Vulnerability analysis
The AMD IOMMU nested domain allocator stores the return value of a domain-ID allocation function into an unsigned integer field before checking whether it indicates failure. Because the allocation function returns a negative errno on failure, storing it in an unsigned variable strips the sign bit and turns the error code into a large positive value, defeating the subsequent error check. The nested domain is then configured with a host domain ID that was never allocated, causing the IOMMU hardware to use invalid or stale page-table entries for DMA translation — potentially breaking device isolation and allowing DMA to reach host memory that should be protected. The fix keeps the return value in a signed integer, tests it there, and only stores it into the unsigned field after confirming it is valid. This path is reachable locally through iommufd ioctls on systems equipped with an AMD IOMMU supporting nested translation; a local user with CAP_IOMMU (obtainable inside a user namespace) can exhaust the domain-ID space and trigger the broken error path.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 7.2 | 7.0 | 7.2.7 | 80c231f55772 |
| mainline | 7.0 | 7.3-rc3 | fa5c0827f0b7 |