Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2025-39961— iommu/amd/pgtbl: Fix possible race while increase page table level

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于AMD IOMMU主机页表实现中存在竞争条件，可能导致读取错误的页表级别。

CVSS 8.8 · High EPSS 0.11% · P1

Possible ATT&CK Techniques 1 AI

T1068 · Exploitation for Privilege Escalation

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 754265bcab78a9014f0f99cd35e0d610fcd7dfa7< 075abf0b1a958acfbea2435003d228e738e90346 affected
754265bcab78a9014f0f99cd35e0d610fcd7dfa7< cd92c8ab336c3a633d46e6f35ebcd3509ae7db3b affected
754265bcab78a9014f0f99cd35e0d610fcd7dfa7< 7d462bdecb7d9c32934dab44aaeb7ea7d73a27a2 affected
754265bcab78a9014f0f99cd35e0d610fcd7dfa7< 1e56310b40fd2e7e0b9493da9ff488af145bdd0c affected
6fb92f18555a7b8e085267d513612dc0ff9a5360 affected
b15bf74405faa1a65025eb8a6eb337e140e5250a affected
0d50f7b1e8c80a8c20db5049e269468c059b0378 affected
785ca708a908b9c596ede852470ba28b8dc3e40b affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-39961

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
iommu/amd/pgtbl: Fix possible race while increase page table level
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: iommu/amd/pgtbl: Fix possible race while increase page table level The AMD IOMMU host page table implementation supports dynamic page table levels (up to 6 levels), starting with a 3-level configuration that expands based on IOVA address. The kernel maintains a root pointer and current page table level to enable proper page table walks in alloc_pte()/fetch_pte() operations. The IOMMU IOVA allocator initially starts with 32-bit address and onces its exhuasted it switches to 64-bit address (max address is determined based on IOMMU and device DMA capability). To support larger IOVA, AMD IOMMU driver increases page table level. But in unmap path (iommu_v1_unmap_pages()), fetch_pte() reads pgtable->[root/mode] without lock. So its possible that in exteme corner case, when increase_address_space() is updating pgtable->[root/mode], fetch_pte() reads wrong page table level (pgtable->mode). It does compare the value with level encoded in page table and returns NULL. This will result is iommu_unmap ops to fail and upper layer may retry/log WARN_ON. CPU 0 CPU 1 ------ ------ map pages unmap pages alloc_pte() -> increase_address_space() iommu_v1_unmap_pages() -> fetch_pte() pgtable->root = pte (new root value) READ pgtable->[mode/root] Reads new root, old mode Updates mode (pgtable->mode += 1) Since Page table level updates are infrequent and already synchronized with a spinlock, implement seqcount to enable lock-free read operations on the read path.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于AMD IOMMU主机页表实现中存在竞争条件，可能导致读取错误的页表级别。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 754265bcab78a9014f0f99cd35e0d610fcd7dfa7 ~ 075abf0b1a958acfbea2435003d228e738e90346 -
Linux Linux 5.3 -

II. Public POCs for CVE-2025-39961

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-39961

请登录查看更多情报信息。

Patches & Fixes for CVE-2025-39961 (1)

Same Patch Batch · Linux · 2025-10-09 · 10 CVEs total

CVE-2025-39963 7.8 HIGH io_uring: fix incorrect io_kiocb reference in io_link_skb
CVE-2025-39956 7.8 HIGH igc: don't fail igc_probe() on LED setup error
CVE-2025-39962 7.5 HIGH rxrpc: Fix untrusted unsigned subtract
CVE-2025-39960 7.3 HIGH gpiolib: acpi: initialize acpi_gpio_info struct
CVE-2025-39957 7.1 HIGH wifi: mac80211: increase scan_ies_len for S1G
CVE-2025-39959 ASoC: amd: acp: Fix incorrect retrival of acp_chip_info
CVE-2025-39958 iommu/s390: Make attach succeed when the device was surprise removed
CVE-2025-39955 tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().
CVE-2025-39954 clk: sunxi-ng: mp: Fix dual-divider clock rate readback

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2025-39961

No comments yet

Leave a comment