LiveActive security incident?Get immediate response
CVE Record

CVE-2025-38594: iommu/vt-d: Fix UAF on sva unbind with pending IOPFs

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix UAF on sva unbind with pending IOPFs Commit 17fce9d2336d ("iommu/vt-d: Put iopf enablement in domain attach path") disables IOPF on device by removing the device from its IOMMU's IOPF queue when the last IOPF-capable domain is detached from the device. Unfortunately, it did this in a wrong place where there are still pending IOPFs. As a result, a use-after-free error is potentially triggered and eventually a kernel panic with a kernel trace similar to the following: refcount_t: underflow; use-after-free. WARNING: CPU: 3 PID: 313 at lib/refcount.c:28 refcount_warn_saturate+0xd8/0xe0 Workqueue: iopf_queue/dmar0-iopfq iommu_sva_handle_iopf Call Trace: <TASK> iopf_free_group+0xe/0x20 process_one_work+0x197/0x3d0 worker_thread+0x23a/0x350 ? rescuer_thread+0x4a0/0x4a0 kthread+0xf8/0x230 ? finish_task_switch.isra.0+0x81/0x260 ? kthreads_online_cpu+0x110/0x110 ? kthreads_online_cpu+0x110/0x110 ret_from_fork+0x13b/0x170 ? kthreads_online_cpu+0x110/0x110 ret_from_fork_asm+0x11/0x20 </TASK> ---[ end trace 0000000000000000 ]--- The intel_pasid_tear_down_entry() function is responsible for blocking hardware from generating new page faults and flushing all in-flight ones. Therefore, moving iopf_for_domain_remove() after this function should resolve this.

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux kernel flaw can mishandle unfinished device page faults during Intel VT-d shared virtual address unbinding. Memory may be used after it is freed, potentially crashing the host. Systems using the affected kernel code and relevant IOMMU features deserve prompt review, especially where less-trusted local users or workloads run.

Executive priority

Prioritize assessment and patching for virtualization, accelerator, and multi-user Linux hosts where a kernel panic would disrupt critical services. Emergency treatment is not supported by current exploitation evidence, but the high CVSS score and potential host-wide failure justify prompt maintenance planning.

Technical view

During SVA unbind, the Intel VT-d code removed a device from its IOPF queue before pending faults were fully blocked and flushed. A worker could then access freed state, causing refcount underflow, use-after-free, and kernel panic. The fix moves domain IOPF removal after intel_pasid_tear_down_entry().

Likely exposure

Exposure is limited to Linux systems containing the affected Intel VT-d code and exercising SVA unbind while I/O page faults remain pending. The bundle identifies the introducing commit and version data involving 6.16, 6.16.1, and 6.17, but does not clearly establish every affected distribution build.

Exploitation context

The CVSS vector describes a local, low-privilege, low-complexity path requiring no user interaction. The supplied record is not in KEV and provides no evidence of active exploitation or a public exploit. The demonstrated outcome is a kernel panic; broader confidentiality or integrity impact is scored but not demonstrated in the description.

Researcher notes

The source demonstrates a race-sensitive lifetime error around pending IOPFs, but supplies no CWE and no exploit confirmation. Version metadata in the bundle is insufficiently clear for distribution-level conclusions. Validate exposure using vendor backport records or commit ancestry rather than relying only on displayed kernel version strings.

Mitigation direction

  • Apply a vendor-supported kernel containing the referenced stable fix.
  • Consult the Linux distribution vendor to map the fix to exact package versions.
  • Reboot affected systems into the updated kernel during an approved maintenance window.
  • Restrict less-trusted local workloads on potentially affected hosts until remediation is confirmed.

Validation and detection

  • Inventory running kernel builds on systems using Intel VT-d and SVA capabilities.
  • Check vendor changelogs for either referenced stable fix or an explicit backport.
  • Confirm the updated kernel is active after reboot, not merely installed.
  • Review kernel logs for refcount underflow, iommu_sva_handle_iopf, IOPF workqueue warnings, or panics.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-38594 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
3Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2025-38594Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux17fce9d2336d952b95474248303e5e7d9777f2e0, 17fce9d2336d952b95474248303e5e7d9777f2e0unaffected
LinuxLinux6.16, 0, 6.16.1, 6.17affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.