CVE-2026-31735

A flaw was found in the Linux kernel's Input/Output Memory Management Unit (IOMMU) page table handling. When an unmap operation partially overlaps with a large memory mapping, the system's invalidation process may not correctly flush the entire unmapped range. This could result in a 'short invalidation,' where some memory remains improperly invalidated. While this issue could potentially lead to data integrity problems or information disclosure, it is currently considered unlikely to be a triggerable bug.

A moderate severity vulnerability was found in the Linux kernel's IOMMU page table (iommupt) implementation. When an unmap operation's ending address lands within the middle of a large or contiguous I/O page table entry, the unmap can remove more memory than was requested, but the gather only flushed the originally requested range rather than the full unmapped extent. This results in a short invalidation, where stale IOTLB entries can remain for the extra range, potentially allowing devices to keep using outdated DMA translations and leading to data integrity problems or system instability. Exploitation requires local access and the ability to drive privileged IOMMU map/unmap operations, and it depends on the special condition of partially unmapping a large mapping; the upstream developer noted that nothing is known to rely on unmapping a large entry, so the bug is considered unlikely to be triggerable in practice. Red Hat rated this flaw as moderate (CVSS 5.5) rather than the upstream CVE.org score of 8.8 because there is no demonstrated confidentiality or integrity impact and the triggering conditions are unlikely to occur. Based on the current assessment, Red Hat Enterprise Linux 6 through 10 (including the kernel-rt variant) and Red Hat In-Vehicle OS 2.0 are not affected because the vulnerable code is not present in Red Hat's shipped kernel versions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.