Riskcovery

CVE-2025-21770

iommu: Fix potential memory leak in iopf_queue_remove_device()

State
Published
Severity
5.5 Medium
Published
Feb 27, 2025
Updated
May 11, 2026
Reserved
Dec 29, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

iommu: Fix potential memory leak in iopf_queue_remove_device()

The iopf_queue_remove_device() helper removes a device from the per-iommu iopf queue when PRI is disabled on the device. It responds to all outstanding iopf's with an IOMMU_PAGE_RESP_INVALID code and detaches the device from the queue.

However, it fails to release the group structure that represents a group of iopf's awaiting for a response after responding to the hardware. This can cause a memory leak if iopf_queue_remove_device() is called with pending iopf's.

Fix it by calling iopf_free_group() after the iopf group is responded.

Scores

CVSSScoreVectorSource
3.15.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HCISA-ADP

Weaknesses

  • CWE-401 Missing Release of Memory after Effective Lifetime

Affected Products

ProductVersions
LinuxLinux
  • 19911232713573a2ebea84a25bd4d71d024ed86b to before db60d2d896a17decd58d143eef92cf22eb0a0176Affected
  • 19911232713573a2ebea84a25bd4d71d024ed86b to before 90d5429cd2921ca2714684ed525898d431bb9283Affected
  • 19911232713573a2ebea84a25bd4d71d024ed86b to before 9759ae2cee7cd42b95f1c48aa3749bd02b5ddb08Affected
LinuxLinux
  • 6.9Affected
  • before 6.9Not affected
  • 6.12.16 through 6.12.*Not affected
  • 6.13.4 through 6.13.*Not affected
  • 6.14 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.