CVE-2025-39961

A race condition flaw was found in the Linux kernel AMD IOMMU page table code when increasing the page table level to support larger IOVA ranges. An unlocked read of the page table root/mode could observe mixed state during an update, causing unmap failures and device mapping errors.

A local user could use this flaw to trigger I/O errors and system instability, resulting in a denial of service.

During address-space growth (increase_address_space()), the AMD IOMMU driver updated the root pointer and mode without readers synchronizing on a sequence counter. Concurrent fetch_pte() in unmap paths could see the new root with the old mode and return NULL, leading upper layers to fail unmaps and warn. The fix adds a seqcount around updates to allow lockless, consistent readers.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent module amd_iommu from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.