CVE-2026-98002

A flaw was found in the Linux kernel's AMD IOMMU (Input-Output Memory Management Unit) driver. This flaw allows a local user to cause a Denial of Service (DoS) or system instability during nested domain allocation. When domain identifiers or memory resources are exhausted, an allocation error value is stored in an unsigned variable before being validated, bypassing the error check. As a result, the driver continues configuring the nested domain with an unallocated host identifier, resulting in unexpected behavior.

A moderate severity flaw was found in the Linux kernel's AMD IOMMU driver. When a nested translation domain is allocated, amd_iommu_pdom_id_alloc() returns either a domain ID or a negative errno such as -ENOSPC when the domain ID space is exhausted or memory is short. That signed return value is stored into the unsigned 32-bit hdom_id field before being tested, so the sign is discarded, the error check never fires, and the nested domain is configured with a host domain ID that was never allocated instead of the allocation failing cleanly. A local user who can trigger nested domain allocation through the IOMMUFD interface can exploit this flaw to cause a denial of service or system instability when domain identifiers or memory resources are exhausted.

The vulnerable code, introduced with the gDomID-to-hDomID mapping support, is present only in Red Hat Enterprise Linux 10 (rhel-10.3 and rhel-10.4) and Red Hat In-Vehicle OS 2 (kernel and kernel-ivos-qualcomm components). Other Red Hat Enterprise Linux streams and the OpenShift Container Platform RHEL CoreOS images do not contain the vulnerable code and are therefore not affected.

The fix for the affected streams is currently deferred: given the moderate, availability-only impact and the narrow preconditions required to reach the flawed code path, it will be addressed in a future update rather than an immediate erratum. Until a fix is delivered, the residual risk is limited to a local user causing denial of service or system instability under IOMMU domain ID or memory exhaustion conditions.

Red Hat rates this flaw as Moderate (CVSS 3.1 base score 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), lower than the Important rating (7.8) in the upstream CVE record. The difference reflects Red Hat's assessment that exploitation requires local access and resource exhaustion preconditions, and that the impact is limited to availability with no demonstrated confidentiality or integrity impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.