CVE-2025-38688

In the Linux kernel, the following vulnerability has been resolved:

iommufd: Prevent ALIGN() overflow

When allocating IOVA the candidate range gets aligned to the target alignment. If the range is close to ULONG_MAX then the ALIGN() can wrap resulting in a corrupted iova.

Open code the ALIGN() using get_add_overflow() to prevent this. This simplifies the checks as we don't need to check for length earlier either.

Consolidate the two copies of this code under a single helper.

This bug would allow userspace to create a mapping that overlaps with some other mapping or a reserved range.

This vulnerability is rated as Moderate severity because exploitation requires local access with permissions to the I/O memory management subsystem and cannot be triggered remotely. In Red Hat Enterprise Linux environments, interaction with the iommufd framework is limited to specialized workloads, such as virtual machine device passthrough or user-space device drivers. A local authenticated attacker with appropriate access could cause integer calculation wrapping during address alignment, resulting in overlapping allocations that compromise memory integrity or trigger a denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.