CVE-2026-98002: iommu/amd: Fix ineffective error check in nested domain allocation
In the Linux kernel, the following vulnerability has been resolved:
iommu/amd: Fix ineffective error check in nested domain allocation
amdiommupdomidalloc() returns an int: a domain ID on success, or the negative errno from idaallocrange() when the ID space is exhausted or memory is short. amdiommuallocdomainnested() stores that return value in gdominfo->hdomid, which is a u32, and only then tests it:
gdominfo->hdomid = amdiommupdomidalloc(); if (gdominfo->hdomid <= 0) {
The assignment discards the sign, so -ENOSPC becomes 0xffffffe4 and the test never fires. The nested domain is then set up with a host domain ID that was never allocated, instead of the allocation failing with -ENOSPC.
Keep the value in an int, test it there, and store it only once it is known to be valid, which is what the other amdiommupdomidalloc() callers already do.
Affected Software
Event History
Frequently Asked Questions
When can this issue be triggered?
It is triggered when nested-domain allocation calls amd_iommu_pdom_id_alloc() and that allocation fails, such as when the domain ID space is exhausted or memory is unavailable.
What is the effect of the failed allocation being mishandled?
A negative allocation error is converted to an unsigned value and accepted as a host domain ID. The nested domain can then be set up with an ID that was never allocated instead of failing with the underlying error.
How can administrators tell whether systems are at risk of encountering it?
Systems that use AMD IOMMU nested-domain allocation can encounter the issue when host domain IDs are exhausted or memory is short. The provided information does not identify a configuration-independent indicator or runtime detection method.