CVE-2025-71089: Linux Kernel IOMMU Privilege Escalation

CVE-2025-71089 Overview

CVE-2025-71089 is a security vulnerability in the Linux kernel related to IOMMU Shared Virtual Addressing (SVA) on x86 architecture. The vulnerability stems from the IOMMU's ability to cache kernel page table entries without receiving proper notification when those page table pages are freed and reallocated. This can lead to Use-After-Free (UAF) and Write-After-Free (WAF) conditions that could potentially be exploited for privilege escalation or data corruption.

Critical Impact

This vulnerability allows the IOMMU to retain stale page table entries after kernel page table pages are freed and reallocated, potentially enabling arbitrary physical memory DMA access or privilege escalation through attacker-controlled memory.

Affected Products

• Linux kernel with CONFIG_X86 enabled
• Systems utilizing IOMMU Shared Virtual Addressing (SVA)
• x86 architecture systems with IOMMU hardware

Discovery Timeline

• 2026-01-13 - CVE CVE-2025-71089 published to NVD
• 2026-01-13 - Last updated in NVD database

Technical Details for CVE-2025-71089

Vulnerability Analysis

In an IOMMU Shared Virtual Addressing context, the IOMMU hardware shares and walks the CPU's page tables. On x86 architecture, the kernel's virtual address space is mapped into the upper portion of every process's page table. This architectural design means that when SVA is enabled, the IOMMU hardware can walk and cache kernel page table entries.

The core issue is that the Linux kernel lacks a notification mechanism for kernel page table changes—specifically when page table pages are freed and reused. While the IOMMU driver receives notifications about changes to user virtual address mappings, it remains unaware of kernel page table modifications. This creates a dangerous scenario where the IOMMU's internal caches retain stale entries for kernel virtual addresses.

Even though SVA contexts are unprivileged and cannot access kernel mappings directly, the IOMMU still walks kernel-only page tables down to leaf entries before determining the mapping is kernel-restricted. During this process, the IOMMU caches intermediate page table entries, making the vulnerability exploitable.

Root Cause

The root cause of this vulnerability is the absence of a synchronization mechanism between kernel page table management and IOMMU cache invalidation. When kernel page table pages are freed, the IOMMU is never notified to flush its paging cache. The IOMMU may then misinterpret newly allocated data in those freed pages as valid page table entries, potentially walking into attacker-controlled memory regions.

Additionally, the IOMMU may continue to write Accessed and Dirty bits to freed memory while attempting to walk stale page tables, constituting a Write-After-Free condition that could corrupt unrelated data structures.

Attack Vector

The attack vector exploits the timing gap between when kernel page table pages are freed and when they are reallocated for other purposes. An attacker could potentially:

1. Trigger the freeing of kernel page table pages through legitimate system operations
2. Allocate memory that reuses the freed page table pages
3. Craft data in the newly allocated memory that the IOMMU interprets as valid page table entries
4. Leverage the IOMMU's stale cache entries to perform unauthorized DMA operations to arbitrary physical memory

The vulnerability mechanism involves race conditions between page table deallocation and IOMMU cache invalidation. When a kernel page table page is freed and reallocated, the IOMMU may still hold cached references to the old page table structure. If the newly allocated memory contains attacker-controlled data, the IOMMU could interpret this data as legitimate page table entries, potentially granting DMA access to arbitrary physical memory regions. For detailed technical analysis, refer to the kernel git commits.

Detection Methods for CVE-2025-71089

Indicators of Compromise

• Unexpected IOMMU faults or errors in kernel logs related to SVA operations
• Anomalous DMA activity patterns or memory access violations
• Kernel page table corruption indicators or unexpected memory state changes
• System instability following IOMMU-related operations on x86 systems

Detection Strategies

• Monitor kernel logs for IOMMU-related error messages and SVA fault conditions
• Implement runtime integrity checking for kernel page table structures
• Use hardware performance counters to detect unusual memory access patterns
• Deploy kernel tracing to monitor page table allocation and deallocation events

Monitoring Recommendations

• Enable IOMMU debug logging to capture detailed SVA operation traces
• Configure system monitoring to alert on unexpected kernel memory allocation patterns
• Implement memory forensics capabilities to detect potential exploitation attempts
• Review system logs regularly for indicators of page table corruption or IOMMU cache inconsistencies

How to Mitigate CVE-2025-71089

Immediate Actions Required

• Apply the latest Linux kernel patches that disable SVA on x86 architecture
• Update to a patched kernel version that includes the deferred freeing mechanism for kernel page table pages
• Review and audit systems using IOMMU SVA functionality on x86 platforms
• Consider temporarily disabling SVA features if immediate patching is not possible

Patch Information

The Linux kernel maintainers have released patches to address this vulnerability by disabling SVA on x86 architecture until the IOMMU can receive proper notification to flush the paging cache before freeing CPU kernel page table pages. The patch series introduces a deferred freeing mechanism for kernel page table pages, providing a safe window to notify the IOMMU to invalidate its caches before pages are reused.

Relevant kernel commits:

• Commit 240cd7f2812c
• Commit 72f98ef9a4be
• Commit c2c3f1a3fd74
• Commit c341dee80b5d

Workarounds

• Disable IOMMU SVA functionality on x86 systems until patches are applied
• Use kernel boot parameters to disable SVA if supported by your kernel version
• Implement additional access controls to limit exposure of IOMMU-enabled devices
• Consider network segmentation and isolation for systems that cannot be immediately patched

# Configuration example
# Disable IOMMU SVA via kernel boot parameter (if supported)
# Add to GRUB_CMDLINE_LINUX in /etc/default/grub:
GRUB_CMDLINE_LINUX="iommu.passthrough=1"

# Update GRUB configuration
sudo update-grub

# Verify IOMMU status after reboot
dmesg | grep -i iommu