CVE-2025-38688

iommufd: Prevent ALIGN() overflow

State: Published
Severity: 8.8 High
Published: Sep 4, 2025
Updated: Oct 15, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

iommufd: Prevent ALIGN() overflow

When allocating IOVA the candidate range gets aligned to the target alignment. If the range is close to ULONG_MAX then the ALIGN() can wrap resulting in a corrupted iova.

Open code the ALIGN() using get_add_overflow() to prevent this. This simplifies the checks as we don't need to check for length earlier either.

Consolidate the two copies of this code under a single helper.

This bug would allow userspace to create a mapping that overlaps with some other mapping or a reserved range.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	51fe6141f0f64ae0bbc096a41a07572273e8c0ef to before d19b817540c0abe84854a64ee9ee34cecc3bbeefAffected 51fe6141f0f64ae0bbc096a41a07572273e8c0ef to before ebb6021560b94649bec6b8faba6fe0dca2218e81Affected 51fe6141f0f64ae0bbc096a41a07572273e8c0ef to before e42a046bb41dcdde4f766a17d8211842007ed537Affected 51fe6141f0f64ae0bbc096a41a07572273e8c0ef to before 79fad1917802c28de51a479318a056a6fbe3e2f2Affected 51fe6141f0f64ae0bbc096a41a07572273e8c0ef to before b42497e3c0e74db061eafad41c0cd7243c46436bAffected
LinuxLinux	6.2Affected before 6.2Not affected 6.6.103 through 6.6.Not affected 6.12.43 through 6.12.Not affected 6.15.11 through 6.15.Not affected 6.16.2 through 6.16.Not affected 6.17 and laterNot affected

Product

Versions

LinuxLinux

51fe6141f0f64ae0bbc096a41a07572273e8c0ef to before d19b817540c0abe84854a64ee9ee34cecc3bbeefAffected
51fe6141f0f64ae0bbc096a41a07572273e8c0ef to before ebb6021560b94649bec6b8faba6fe0dca2218e81Affected
51fe6141f0f64ae0bbc096a41a07572273e8c0ef to before e42a046bb41dcdde4f766a17d8211842007ed537Affected
51fe6141f0f64ae0bbc096a41a07572273e8c0ef to before 79fad1917802c28de51a479318a056a6fbe3e2f2Affected
51fe6141f0f64ae0bbc096a41a07572273e8c0ef to before b42497e3c0e74db061eafad41c0cd7243c46436bAffected

LinuxLinux

6.2Affected
before 6.2Not affected
6.6.103 through 6.6.*Not affected
6.12.43 through 6.12.*Not affected
6.15.11 through 6.15.*Not affected
6.16.2 through 6.16.*Not affected
6.17 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.