UBUNTU-CVE-2026-98002: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix ineffective error check in nested domain allocation amdiommupdomidalloc() returns an int: a domain ID on success, or the negative errno from idaallocrange() when the ID space is exhausted or memory is short. amdiommuallocdomainnested() stores that return value in gdominfo->hdomid, which is a u32, and only then tests it: gdominfo->hdomid = amdiommupdomidalloc(); if (gdominfo->hdomid <= 0) { The assignment discards the sign, so -ENOSPC becomes 0xffffffe4 and the test never fires. The nested domain is then set up with a host domain ID that was never allocated, instead of the allocation failing with -ENOSPC. Keep the value in an int, test it there, and store it only once it is known to be valid, which is what the other amdiommupdomidalloc() callers already do.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The issue applies to the listed Ubuntu kernel packages when AMD IOMMU nested-domain allocation is used. The faulty path is reached while allocating a host domain ID for a nested domain.
What does an attacker need to exploit it?
The supplied vector indicates local access, low privileges, no user interaction, and high attack complexity. Exploitation also depends on triggering nested-domain allocation when the domain-ID allocator cannot provide an ID.
When does the allocation error get mishandled?
The error is mishandled when domain-ID allocation fails, such as when the ID space is exhausted or memory is short. A negative allocation error is stored in an unsigned field, causing the nested domain to be set up with an ID that was not allocated instead of failing the request.