CVE-2026-98003: iommu/amd: Do not reallocate GA log buffers on resume
In the Linux kernel, the following vulnerability has been resolved:
iommu/amd: Do not reallocate GA log buffers on resume
Commit c5e1a1eb9279 ("iommu/amd: Simplify and Consolidate Virtual APIC (AVIC) Enablement") moved the GA log allocation from iommuinitpci() to enableiommusvapic(), which is called on every resume.
iommuinitgalog() assigns iommu->galog and iommu->galogtail unconditionally. Each resume therefore replaces the boot-time pointers and leaks both old allocations. The function also uses GFPKERNEL from a syscore resume callback, where interrupts are disabled and the non-boot CPUs are offline.
Return early if both buffers are already allocated. Clear the pointers in freegalog() so a partial allocation failure cannot leave galog dangling.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In iommu_init_ga_log(), return early when both GA log buffers are already allocated, and clear ga_log and ga_log_tail in free_ga_log() so partial allocation failures cannot leave dangling pointers.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The issue affects Linux kernel systems using the AMD IOMMU GA log path where Virtual APIC (AVIC) enablement runs. The problematic allocation path is invoked during system resume.
What event triggers the leak and unsafe allocation context?
Each system resume calls enable_iommus_vapic(), which can reallocate GA log buffers and replace the existing pointers. This occurs from a syscore resume callback while interrupts are disabled and non-boot CPUs are offline.
How can I tell whether a system is affected?
A vulnerable kernel reallocates GA log buffers on every resume instead of retaining already allocated buffers. Repeated suspend/resume cycles can therefore leak the prior GA log allocations; partial allocation failure may also leave ga_log dangling.
What does the fix change?
The fix returns early when both GA log buffers are already allocated, preventing replacement of the boot-time pointers on resume. It also clears the pointers in free_ga_log() to prevent a dangling ga_log pointer after a partial allocation failure.