CVE-2025-38062

A flaw was found in the Linux kernel. A local attacker could exploit a race condition in the Message Signaled Interrupts (MSI) translation path when the IOMMU (Input/Output Memory Management Unit) domain is changed during Virtual Function I/O (VFIO) operation. This could lead to a Use-After-Free (UAF) vulnerability.

A use-after-free flaw was found in the Linux kernel's Message Signaled Interrupts (MSI) translation path. When a device is managed through VFIO using iommufd, the IOMMU domain can be changed while VFIO is running. A local user with access to such a device can race the VFIO_DEVICE_ATTACH_IOMMUFD_PT operation (which attaches an IOMMU domain) against VFIO_DEVICE_SET_IRQS (which composes the translated MSI message). This race can cause the MSI cookie pointer and an unlocked call to iommu_get_domain_for_dev() on the MSI translation path to be used after free, potentially leading to a kernel crash or, at worst, privilege escalation, information disclosure, or data corruption. Red Hat rates this flaw as Moderate severity (CVSS 6.5, AV:L/AC:H/PR:L) because exploitation requires local access to a VFIO device through iommufd and winning a race condition, which increases attack complexity; this is lower than the upstream CVE.org rating of Important (7.8). Red Hat Enterprise Linux 8, 9, and 10 (kernel and kernel-rt) and Red Hat In-Vehicle OS 1 are affected because they ship the vulnerable iommufd/VFIO MSI translation code. Red Hat Enterprise Linux 6 and 7 are not affected because the vulnerable code is not present in those kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.