Bug 2393196 (CVE-2025-38688) - CVE-2025-38688 kernel: iommufd: Prevent ALIGN() overflow
Summary: CVE-2025-38688 kernel: iommufd: Prevent ALIGN() overflow
Keywords:
Status: NEW
Alias: CVE-2025-38688
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-09-04 16:04 UTC by OSIDB Bzimport
Modified: 2025-09-04 17:33 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2025-09-04 16:04:19 UTC
In the Linux kernel, the following vulnerability has been resolved:

iommufd: Prevent ALIGN() overflow

When allocating IOVA the candidate range gets aligned to the target
alignment. If the range is close to ULONG_MAX then the ALIGN() can
wrap resulting in a corrupted iova.

Open code the ALIGN() using get_add_overflow() to prevent this.
This simplifies the checks as we don't need to check for length earlier
either.

Consolidate the two copies of this code under a single helper.

This bug would allow userspace to create a mapping that overlaps with some
other mapping or a reserved range.


Note You need to log in before you can comment on or make changes to this bug.