CVE-2025-68760: iommu/amd: Fix potential out-of-bounds read in iommu_mmio_show
In the Linux kernel, the following vulnerability has been resolved:
iommu/amd: Fix potential out-of-bounds read in iommummioshow
In iommummiowrite(), it validates the user-provided offset with the check: iommu->dbgmmiooffset > iommu->mmiophysend - 4. This assumes a 4-byte access. However, the corresponding show handler, iommummioshow(), uses readq() to perform an 8-byte (64-bit) read.
If a user provides an offset equal to mmiophysend - 4, the check passes, and will lead to a 4-byte out-of-bounds read.
Fix this by adjusting the boundary check to use sizeof(u64), which corresponds to the size of the readq() operation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Adjust the boundary check to account for the 8-byte readq() operation by using sizeof(u64) instead of subtracting 4.
Linux kernel AMD IOMMU iommu_mmio_show iommu->dbg_mmio_offset boundary check = sizeof(u64)
Event History
Frequently Asked Questions
What is the severity of CVE-2025-68760?
CVE-2025-68760 has been classified as medium severity due to the potential out-of-bounds read in the iommu subsystem.
How do I fix CVE-2025-68760?
To mitigate CVE-2025-68760, upgrading to the patched version of the Linux kernel that addresses the vulnerability is recommended.
Which versions of the Linux kernel are affected by CVE-2025-68760?
CVE-2025-68760 affects specific versions of the Linux kernel that utilize the amd iommu subsystem.
What impact does CVE-2025-68760 have on system security?
CVE-2025-68760 could allow an attacker to cause a denial of service or possibly gain elevated privileges through an out-of-bounds access.
Is there an exploit available for CVE-2025-68760?
As of now, public knowledge of an active exploit for CVE-2025-68760 has not been reported, but the risk remains if not patched.