CVE-2025-39939

In the Linux kernel, the following vulnerability has been resolved:

iommu/s390: Fix memory corruption when using identity domain

zpci_get_iommu_ctrs() returns counter information to be reported as part of device statistics; these counters are stored as part of the s390_domain. The problem, however, is that the identity domain is not backed by an s390_domain and so the conversion via to_s390_domain() yields a bad address that is zero'd initially and read on-demand later via a sysfs read. These counters aren't necessary for the identity domain; just return NULL in this case.

This issue was discovered via KASAN with reports that look like: BUG: KASAN: global-out-of-bounds in zpci_fmb_enable_device when using the identity domain for a device on s390.

This vulnerability is rated as having a Moderate impact because it is restricted to IBM Z (s390x) platforms and requires local privileged access to trigger identity domain operations on PCI devices. On affected systems, improper pointer handling in the IOMMU statistics reporting routine can result in out-of-bounds memory access and kernel memory corruption during device monitoring. The flaw cannot be exploited remotely and does not affect non-s390 architectures, significantly limiting the exposure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.