In the Linux kernel, the following vulnerability has been resolved:
iommu/amd/pgtbl: Fix possible race while increase page table level
The AMD IOMMU host page table implementation supports dynamic page table levels (up to 6 levels), starting with a 3-level configuration that expands based on IOVA address. The kernel maintains a root pointer and current page table level to enable proper page table walks in allocpte()/fetchpte() operations.
The IOMMU IOVA allocator initially starts with 32-bit address and onces its exhuasted it switches to 64-bit address (max address is determined based on IOMMU and device DMA capability). To support larger IOVA, AMD IOMMU driver increases page table level.
But in unmap path (iommuv1unmappages()), fetchpte() reads pgtable->[root/mode] without lock. So its possible that in exteme corner case, when increaseaddressspace() is updating pgtable->[root/mode], fetchpte() reads wrong page table level (pgtable->mode). It does compare the value with level encoded in page table and returns NULL. This will result is iommuunmap ops to fail and upper layer may retry/log WARN_ON.
CPU 0 CPU 1 ------ ------ map pages unmap pages allocpte() -> increaseaddressspace() iommuv1unmappages() -> fetch_pte() pgtable->root = pte (new root value) READ pgtable->[mode/root] Reads new root, old mode Updates mode (pgtable->mode += 1)
Since Page table level updates are infrequent and already synchronized with a spinlock, implement seqcount to enable lock-free read operations on the read path.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/39xxx/CVE-2025-39961.json"
}"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-39961.json"
[
{
"deprecated": false,
"digest": {
"function_hash": "319417978683491995434848595735249637179",
"length": 1402.0
},
"signature_type": "Function",
"target": {
"file": "drivers/iommu/amd/io_pgtable.c",
"function": "alloc_pte"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cd92c8ab336c3a633d46e6f35ebcd3509ae7db3b",
"id": "CVE-2025-39961-00c79a26",
"signature_version": "v1"
},
{
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"305008525481616403910905400168018844031",
"240149557923659087081846829242495550879",
"1516451835001253441137563242857987414",
"227868922190578232227615710347329110854"
]
},
"signature_type": "Line",
"target": {
"file": "drivers/iommu/amd/amd_iommu_types.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1e56310b40fd2e7e0b9493da9ff488af145bdd0c",
"id": "CVE-2025-39961-033a4a0a",
"signature_version": "v1"
},
{
"deprecated": false,
"digest": {
"function_hash": "186899349168095910680878765204466357940",
"length": 638.0
},
"signature_type": "Function",
"target": {
"file": "drivers/iommu/amd/io_pgtable.c",
"function": "v1_alloc_pgtable"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7d462bdecb7d9c32934dab44aaeb7ea7d73a27a2",
"id": "CVE-2025-39961-171a9964",
"signature_version": "v1"
},
{
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"318311176681206389811900937079196965896",
"23171744486052938640308854514680697273",
"68605813643305913768940295525686318092",
"266805484356460468345231409303890140143",
"88101116684288893141752795390336588821",
"112597858068890000463343596930623733089",
"274954720239726235418229526866342661529",
"278026817612448923190822523158393980398",
"201676391154011320445070887918172941156",
"308766924290861053477760707000590289900",
"162060711756516280388213152289518743575",
"333697207240580702262555094930974268145",
"134609474290568739641149971355706694316",
"332623570806465439402497606832040761063",
"270378200130614382532752776266714581556",
"147756268623051505083304057198870705157",
"175968355111699447672683977740866448297",
"306330864106944953313341546576340763511",
"308885299433351496039162700372780887820",
"227366079440608174607872913865900502358",
"141135639161836999636125756974913009113",
"271393431849087430450804325684380655579",
"8621516055312727475938363408847126010",
"75140821698986409408546067704982522418",
"297946501161472557353561685986365587745",
"336863190326772219604347822716339024270",
"141412623309887507737210316701257762832",
"47273099214475271511468509914597027873",
"151257887744292828868836015427932559782",
"338863968988697720453136535470177613845",
"218119300396686815458020257893417188878"
]
},
"signature_type": "Line",
"target": {
"file": "drivers/iommu/amd/io_pgtable.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cd92c8ab336c3a633d46e6f35ebcd3509ae7db3b",
"id": "CVE-2025-39961-17f28e96",
"signature_version": "v1"
},
{
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"305008525481616403910905400168018844031",
"240149557923659087081846829242495550879",
"1516451835001253441137563242857987414",
"227868922190578232227615710347329110854"
]
},
"signature_type": "Line",
"target": {
"file": "drivers/iommu/amd/amd_iommu_types.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cd92c8ab336c3a633d46e6f35ebcd3509ae7db3b",
"id": "CVE-2025-39961-25e98784",
"signature_version": "v1"
},
{
"deprecated": false,
"digest": {
"function_hash": "286593272607322691893671400605749391427",
"length": 807.0
},
"signature_type": "Function",
"target": {
"file": "drivers/iommu/amd/io_pgtable.c",
"function": "increase_address_space"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7d462bdecb7d9c32934dab44aaeb7ea7d73a27a2",
"id": "CVE-2025-39961-2c07af79",
"signature_version": "v1"
},
{
"deprecated": false,
"digest": {
"function_hash": "208218499842854193363986788770416605391",
"length": 731.0
},
"signature_type": "Function",
"target": {
"file": "drivers/iommu/amd/io_pgtable.c",
"function": "increase_address_space"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@075abf0b1a958acfbea2435003d228e738e90346",
"id": "CVE-2025-39961-2f3f44b9",
"signature_version": "v1"
},
{
"deprecated": false,
"digest": {
"function_hash": "276959956263881649552468936360767053205",
"length": 1410.0
},
"signature_type": "Function",
"target": {
"file": "drivers/iommu/amd/io_pgtable.c",
"function": "alloc_pte"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7d462bdecb7d9c32934dab44aaeb7ea7d73a27a2",
"id": "CVE-2025-39961-3897f01c",
"signature_version": "v1"
},
{
"deprecated": false,
"digest": {
"function_hash": "276959956263881649552468936360767053205",
"length": 1410.0
},
"signature_type": "Function",
"target": {
"file": "drivers/iommu/amd/io_pgtable.c",
"function": "alloc_pte"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1e56310b40fd2e7e0b9493da9ff488af145bdd0c",
"id": "CVE-2025-39961-44e33159",
"signature_version": "v1"
},
{
"deprecated": false,
"digest": {
"function_hash": "24149619388303318634033891616997344208",
"length": 713.0
},
"signature_type": "Function",
"target": {
"file": "drivers/iommu/amd/io_pgtable.c",
"function": "fetch_pte"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1e56310b40fd2e7e0b9493da9ff488af145bdd0c",
"id": "CVE-2025-39961-4e687016",
"signature_version": "v1"
},
{
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"207053112273666208541662334171449415441",
"114076715630992598799709200878392129143",
"291711646563613737641996598823363125629",
"328406962832047047423934509114768263306"
]
},
"signature_type": "Line",
"target": {
"file": "drivers/iommu/amd/amd_iommu_types.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@075abf0b1a958acfbea2435003d228e738e90346",
"id": "CVE-2025-39961-5e37733a",
"signature_version": "v1"
},
{
"deprecated": false,
"digest": {
"function_hash": "223256817144508051899831370590341006430",
"length": 809.0
},
"signature_type": "Function",
"target": {
"file": "drivers/iommu/amd/io_pgtable.c",
"function": "increase_address_space"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1e56310b40fd2e7e0b9493da9ff488af145bdd0c",
"id": "CVE-2025-39961-715b2fc5",
"signature_version": "v1"
},
{
"deprecated": false,
"digest": {
"function_hash": "24149619388303318634033891616997344208",
"length": 713.0
},
"signature_type": "Function",
"target": {
"file": "drivers/iommu/amd/io_pgtable.c",
"function": "fetch_pte"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@075abf0b1a958acfbea2435003d228e738e90346",
"id": "CVE-2025-39961-906d590a",
"signature_version": "v1"
},
{
"deprecated": false,
"digest": {
"function_hash": "208422139661653669744238146013509039122",
"length": 442.0
},
"signature_type": "Function",
"target": {
"file": "drivers/iommu/amd/io_pgtable.c",
"function": "v1_alloc_pgtable"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@075abf0b1a958acfbea2435003d228e738e90346",
"id": "CVE-2025-39961-94dc8684",
"signature_version": "v1"
},
{
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"318311176681206389811900937079196965896",
"23171744486052938640308854514680697273",
"68605813643305913768940295525686318092",
"266805484356460468345231409303890140143",
"88101116684288893141752795390336588821",
"112597858068890000463343596930623733089",
"274954720239726235418229526866342661529",
"278026817612448923190822523158393980398",
"201676391154011320445070887918172941156",
"308766924290861053477760707000590289900",
"162060711756516280388213152289518743575",
"333697207240580702262555094930974268145",
"134609474290568739641149971355706694316",
"332623570806465439402497606832040761063",
"270378200130614382532752776266714581556",
"147756268623051505083304057198870705157",
"175968355111699447672683977740866448297",
"306330864106944953313341546576340763511",
"308885299433351496039162700372780887820",
"227366079440608174607872913865900502358",
"141135639161836999636125756974913009113",
"271393431849087430450804325684380655579",
"8621516055312727475938363408847126010",
"75140821698986409408546067704982522418",
"297946501161472557353561685986365587745",
"336863190326772219604347822716339024270",
"141412623309887507737210316701257762832",
"105537432319563911013855465684863519341",
"151257887744292828868836015427932559782",
"338863968988697720453136535470177613845",
"218119300396686815458020257893417188878"
]
},
"signature_type": "Line",
"target": {
"file": "drivers/iommu/amd/io_pgtable.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7d462bdecb7d9c32934dab44aaeb7ea7d73a27a2",
"id": "CVE-2025-39961-96c2f886",
"signature_version": "v1"
},
{
"deprecated": false,
"digest": {
"function_hash": "2895221888834760821454369479921398718",
"length": 630.0
},
"signature_type": "Function",
"target": {
"file": "drivers/iommu/amd/io_pgtable.c",
"function": "v1_alloc_pgtable"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cd92c8ab336c3a633d46e6f35ebcd3509ae7db3b",
"id": "CVE-2025-39961-a2d1ea2c",
"signature_version": "v1"
},
{
"deprecated": false,
"digest": {
"function_hash": "186899349168095910680878765204466357940",
"length": 638.0
},
"signature_type": "Function",
"target": {
"file": "drivers/iommu/amd/io_pgtable.c",
"function": "v1_alloc_pgtable"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1e56310b40fd2e7e0b9493da9ff488af145bdd0c",
"id": "CVE-2025-39961-a8c41cd1",
"signature_version": "v1"
},
{
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"318311176681206389811900937079196965896",
"23171744486052938640308854514680697273",
"68605813643305913768940295525686318092",
"266805484356460468345231409303890140143",
"178670119142066097722619793291487507373",
"112597858068890000463343596930623733089",
"274954720239726235418229526866342661529",
"278026817612448923190822523158393980398",
"201676391154011320445070887918172941156",
"308766924290861053477760707000590289900",
"162060711756516280388213152289518743575",
"333697207240580702262555094930974268145",
"134609474290568739641149971355706694316",
"332623570806465439402497606832040761063",
"270378200130614382532752776266714581556",
"147756268623051505083304057198870705157",
"175968355111699447672683977740866448297",
"306330864106944953313341546576340763511",
"308885299433351496039162700372780887820",
"227366079440608174607872913865900502358",
"141135639161836999636125756974913009113",
"271393431849087430450804325684380655579",
"8621516055312727475938363408847126010",
"75140821698986409408546067704982522418",
"297946501161472557353561685986365587745",
"336863190326772219604347822716339024270",
"141412623309887507737210316701257762832",
"105537432319563911013855465684863519341",
"151257887744292828868836015427932559782",
"338863968988697720453136535470177613845",
"218119300396686815458020257893417188878"
]
},
"signature_type": "Line",
"target": {
"file": "drivers/iommu/amd/io_pgtable.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1e56310b40fd2e7e0b9493da9ff488af145bdd0c",
"id": "CVE-2025-39961-a9b81393",
"signature_version": "v1"
},
{
"deprecated": false,
"digest": {
"function_hash": "3034832917391916413192665717986585062",
"length": 1292.0
},
"signature_type": "Function",
"target": {
"file": "drivers/iommu/amd/io_pgtable.c",
"function": "alloc_pte"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@075abf0b1a958acfbea2435003d228e738e90346",
"id": "CVE-2025-39961-b3364546",
"signature_version": "v1"
},
{
"deprecated": false,
"digest": {
"function_hash": "24149619388303318634033891616997344208",
"length": 713.0
},
"signature_type": "Function",
"target": {
"file": "drivers/iommu/amd/io_pgtable.c",
"function": "fetch_pte"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cd92c8ab336c3a633d46e6f35ebcd3509ae7db3b",
"id": "CVE-2025-39961-c238eaea",
"signature_version": "v1"
},
{
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"318311176681206389811900937079196965896",
"23171744486052938640308854514680697273",
"68605813643305913768940295525686318092",
"266805484356460468345231409303890140143",
"153148412845315819892046062199770388715",
"192987323571363674551992240578395603965",
"60514796912171903208165976937138012637",
"29009536842844729711673004742501320324",
"134058624932126634002404824262838274608",
"83710946226064566796183332107305513981",
"52305863686982236172091882914579332861",
"30056589062011155423884351715492660579",
"74413184339140754435070566865227397825",
"55815162360799575470183880698039706245",
"150173310876980274996424102213057160277",
"180323800040880349556674712908773262667",
"175007193092828306003566837246991349770",
"206725601826235860550109882922430328361",
"308885299433351496039162700372780887820",
"227366079440608174607872913865900502358",
"141135639161836999636125756974913009113",
"271393431849087430450804325684380655579",
"8621516055312727475938363408847126010",
"75140821698986409408546067704982522418",
"297946501161472557353561685986365587745",
"336863190326772219604347822716339024270",
"141412623309887507737210316701257762832",
"270889063379824901348623484506973427043",
"288040615371257080813134478843833259964",
"81081622957249503336231466543945409571"
]
},
"signature_type": "Line",
"target": {
"file": "drivers/iommu/amd/io_pgtable.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@075abf0b1a958acfbea2435003d228e738e90346",
"id": "CVE-2025-39961-d3432ff5",
"signature_version": "v1"
},
{
"deprecated": false,
"digest": {
"function_hash": "24149619388303318634033891616997344208",
"length": 713.0
},
"signature_type": "Function",
"target": {
"file": "drivers/iommu/amd/io_pgtable.c",
"function": "fetch_pte"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7d462bdecb7d9c32934dab44aaeb7ea7d73a27a2",
"id": "CVE-2025-39961-d42d62fa",
"signature_version": "v1"
},
{
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"305008525481616403910905400168018844031",
"240149557923659087081846829242495550879",
"1516451835001253441137563242857987414",
"227868922190578232227615710347329110854"
]
},
"signature_type": "Line",
"target": {
"file": "drivers/iommu/amd/amd_iommu_types.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7d462bdecb7d9c32934dab44aaeb7ea7d73a27a2",
"id": "CVE-2025-39961-d65c8a74",
"signature_version": "v1"
},
{
"deprecated": false,
"digest": {
"function_hash": "49918826079752512983518233886878328634",
"length": 799.0
},
"signature_type": "Function",
"target": {
"file": "drivers/iommu/amd/io_pgtable.c",
"function": "increase_address_space"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cd92c8ab336c3a633d46e6f35ebcd3509ae7db3b",
"id": "CVE-2025-39961-e2f67980",
"signature_version": "v1"
}
]