CVE-2025-40058

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-40058", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.158Z", "datePublished": "2025-10-28T11:48:31.567Z", "dateUpdated": "2026-08-05T12:07:25.986Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:07:25.986Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: Disallow dirty tracking if incoherent page walk\n\nDirty page tracking relies on the IOMMU atomically updating the dirty bit\nin the paging-structure entry. For this operation to succeed, the paging-\nstructure memory must be coherent between the IOMMU and the CPU. In\nanother word, if the iommu page walk is incoherent, dirty page tracking\ndoesn't work.\n\nThe Intel VT-d specification, Section 3.10 \"Snoop Behavior\" states:\n\n\"Remapping hardware encountering the need to atomically update A/EA/D bits\n in a paging-structure entry that is not snooped will result in a non-\n recoverable fault.\"\n\nTo prevent an IOMMU from being incorrectly configured for dirty page\ntracking when it is operating in an incoherent mode, mark SSADS as\nsupported only when both ecap_slads and ecap_smpwc are supported."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable configuration is reached only through local ioctls on /dev/iommu (IOMMU_HWPT_ALLOC with IOMMU_HWPT_ALLOC_DIRTY_TRACKING, then IOMMU_HWPT_SET_DIRTY_TRACKING) against a bound VFIO device fd. There is no network-facing path into the VT-d dirty-tracking code.\nAC:L - On an affected IOMMU the attacker deterministically allocates the dirty-tracking hwpt and enables SSADE with two ioctls \u2014 no race to win and no memory layout to groom. Where the IOMMU is emulated for a guest, the ecap_slads=1/ecap_smpwc=0 combination is itself under attacker or hypervisor control.\nPR:L - Access to /dev/iommu plus a VFIO device fd is required, which in standard device-assignment deployments is delegated to the unprivileged VMM user (qemu/libvirt) rather than requiring real root. A compromised VMM process or a user in a device-assignment group can drive the entire sequence.\nUI:N - The full sequence \u2014 hwpt allocation, dirty-tracking enable, and the subsequent device DMA \u2014 is driven entirely by the attacker's own process and the device it already controls. No victim action is needed.\nS:C - The defect is in the IOMMU's own DMA-isolation enforcement: SSADE is programmed on hardware that cannot coherently update paging-structure entries, and the unflushed cached RMW in intel_iommu_read_and_clear_dirty() can resurrect stale second-stage PTEs. An assigned device's DMA then reaches memory outside its authorized translation, crossing the IOMMU security boundary.\nC:H - Stale or incorrectly-updated second-stage paging entries leave a device-visible mapping to host pages that have been unmapped and potentially reassigned, giving the controlled device DMA reads of arbitrary host memory. Dirty-bitmap results are also unreliable, leaking incorrect state across a migration boundary.\nI:H - The same stale-translation window gives the assigned device DMA writes into host memory outside its mapping \u2014 an arbitrary write primitive from the device side that defeats IOMMU containment. Silently missed dirty pages additionally corrupt guest memory state on live migration.\nA:H - The VT-d specification mandates a non-recoverable fault whenever the hardware must atomically update A/EA/D bits in a non-snooped paging-structure entry, so the assigned device's DMA is blocked outright and the DMAR fault handler is driven repeatedly. The device and any VM depending on it are rendered inoperable."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/iommu/intel/iommu.h"], "versions": [{"version": "f35f22cc760eb2c7034bf53251399685d611e03f", "lessThan": "ebe16d245a00626bb87163862a1b07daf5475a3e", "status": "affected", "versionType": "git"}, {"version": "f35f22cc760eb2c7034bf53251399685d611e03f", "lessThan": "8d096ce0e87bdc361f0b25d7943543bc53aa0b9e", "status": "affected", "versionType": "git"}, {"version": "f35f22cc760eb2c7034bf53251399685d611e03f", "lessThan": "57f55048e564dedd8a4546d018e29d6bbfff0a7e", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/iommu/intel/iommu.h"], "versions": [{"version": "6.7", "status": "affected"}, {"version": "0", "lessThan": "6.7", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.53", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17.3", "lessThanOrEqual": "6.17.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.12.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.17.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.18"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ebe16d245a00626bb87163862a1b07daf5475a3e"}, {"url": "https://git.kernel.org/stable/c/8d096ce0e87bdc361f0b25d7943543bc53aa0b9e"}, {"url": "https://git.kernel.org/stable/c/57f55048e564dedd8a4546d018e29d6bbfff0a7e"}], "title": "iommu/vt-d: Disallow dirty tracking if incoherent page walk", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/iommu/intel/iommu.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "ebe16d245a00626bb87163862a1b07daf5475a3e", "status": "affected", "version": "f35f22cc760eb2c7034bf53251399685d611e03f", "versionType": "git"}, {"lessThan": "8d096ce0e87bdc361f0b25d7943543bc53aa0b9e", "status": "affected", "version": "f35f22cc760eb2c7034bf53251399685d611e03f", "versionType": "git"}, {"lessThan": "57f55048e564dedd8a4546d018e29d6bbfff0a7e", "status": "affected", "version": "f35f22cc760eb2c7034bf53251399685d611e03f", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/iommu/intel/iommu.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.7"}, {"lessThan": "6.7", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.53", "versionType": "semver"}, {"lessThanOrEqual": "6.17.*", "status": "unaffected", "version": "6.17.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: Disallow dirty tracking if incoherent page walk\n\nDirty page tracking relies on the IOMMU atomically updating the dirty bit\nin the paging-structure entry. For this operation to succeed, the paging-\nstructure memory must be coherent between the IOMMU and the CPU. In\nanother word, if the iommu page walk is incoherent, dirty page tracking\ndoesn't work.\n\nThe Intel VT-d specification, Section 3.10 \"Snoop Behavior\" states:\n\n\"Remapping hardware encountering the need to atomically update A/EA/D bits\n in a paging-structure entry that is not snooped will result in a non-\n recoverable fault.\"\n\nTo prevent an IOMMU from being incorrectly configured for dirty page\ntracking when it is operating in an incoherent mode, mark SSADS as\nsupported only when both ecap_slads and ecap_smpwc are supported."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\niommu/vt-d: No permitir el seguimiento de p\u00e1ginas modificadas si el recorrido de p\u00e1gina es incoherente\n\nEl seguimiento de p\u00e1ginas modificadas depende de que la IOMMU actualice at\u00f3micamente el bit de p\u00e1gina modificada en la entrada de la estructura de paginaci\u00f3n. Para que esta operaci\u00f3n tenga \u00e9xito, la memoria de la estructura de paginaci\u00f3n debe ser coherente entre la IOMMU y la CPU. En otras palabras, si el recorrido de p\u00e1gina de la iommu es incoherente, el seguimiento de p\u00e1ginas modificadas no funciona.\n\nLa especificaci\u00f3n Intel VT-d, Secci\u00f3n 3.10 'Comportamiento de Snoop' establece:\n\n'El hardware de reasignaci\u00f3n que encuentre la necesidad de actualizar at\u00f3micamente los bits A/EA/D en una entrada de estructura de paginaci\u00f3n que no sea supervisada resultar\u00e1 en una falla no recuperable.'\n\nPara evitar que una IOMMU sea configurada incorrectamente para el seguimiento de p\u00e1ginas modificadas cuando opera en un modo incoherente, marque SSADS como compatible solo cuando tanto ecap_slads como ecap_smpwc sean compatibles."}], "id": "CVE-2025-40058", "lastModified": "2026-10-19T21:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 6.0, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2025-10-28T12:15:40.150", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/57f55048e564dedd8a4546d018e29d6bbfff0a7e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8d096ce0e87bdc361f0b25d7943543bc53aa0b9e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ebe16d245a00626bb87163862a1b07daf5475a3e"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: iommu/vt-d: Disallow dirty tracking if incoherent page walk", "id": "2406776", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2406776"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2025-40058", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-10-28T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-40058\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-40058\nhttps://lore.kernel.org/linux-cve-announce/2025102815-CVE-2025-40058-0eba@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-10-29T10:57:51.423971+00:00", "updated": "2025-10-29T10:57:51.423995+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}