SB20260502105 - Improper control of a resource through its lifetime in Linux kernel iommu generic_pt driver

Description

This security bulletin contains information about 1 vulnerability.

1) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-31735)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper invalidation handling in the iommu unmap gather logic when unmapping a range that ends within the middle of a large or contiguous IOPTE. A local user can trigger an unmap operation in this condition to cause a denial of service.

The issue results from the invalidation range not being extended to cover the full unmapped area when unmap removes more memory than was originally requested.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/50ecd96a28f712f8b682c0441f4cb9b086d28816
• https://git.kernel.org/stable/c/ee6e69d032550687a3422504bfca3f834c7b5061