CVE-2025-40155

A flaw was found in the Linux kernel's IOMMU VT-d debugfs code: in legacy mode page-table dump logic, if the translation type (TT) is neither 00b nor 01b, the SSPTPTR value may be left uninitialized or zero. This can lead to a general protection fault (GPF) when debugfs walks page tables under these conditions.

This vulnerability is rated with a Moderate severity because exploitation requires local access to the debugfs hierarchy and leads exclusively to a denial of service (kernel oops) without compromising data integrity or confidentiality. In default Red Hat Enterprise Linux environments, debugfs is restricted to privileged administrative accounts, mitigating exposure to unprivileged local users. Triggering the crash additionally requires hardware operating with Intel VT-d IOMMU in legacy translation mode alongside deliberate interaction with the debugfs page-table dump interface.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.