CVE-2026-92505: iommu/amd: Fix undefined behavior in devid_write debugfs function
In the Linux kernel, the following vulnerability has been resolved:
iommu/amd: Fix undefined behavior in devidwrite debugfs function
When foreachpcisegment() loop completes without finding a matching segment, the pciseg pointer is not NULL but points to an invalid memory location (the list head). Accessing pciseg->id after the loop causes undefined behavior.
Fix this by handling the successful case inside the loop and returning -EINVAL after the loop if no matching segment is found.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to trigger this issue?
The vulnerable code is in the devid_write debugfs function, so triggering it requires the ability to write to the relevant debugfs interface. The provided information does not identify the required privilege level or debugfs file permissions.
When does the undefined behavior occur?
It occurs when the PCI-segment iteration finishes without finding a segment matching the requested value. The code then accesses pci_seg->id even though pci_seg points to the list head rather than a valid segment.
What behavior does the fix introduce for an unknown segment?
The corrected code handles a matching segment within the iteration loop. If no matching segment is found, it returns -EINVAL instead of accessing an invalid pointer.