CVE-2025-40058

{
  "id": "CVE-2025-40058",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2025-10-28T12:15:40.150",
  "lastModified": "2026-10-19T21:10:00.160",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: Disallow dirty tracking if incoherent page walk\n\nDirty page tracking relies on the IOMMU atomically updating the dirty bit\nin the paging-structure entry. For this operation to succeed, the paging-\nstructure memory must be coherent between the IOMMU and the CPU. In\nanother word, if the iommu page walk is incoherent, dirty page tracking\ndoesn't work.\n\nThe Intel VT-d specification, Section 3.10 \"Snoop Behavior\" states:\n\n\"Remapping hardware encountering the need to atomically update A/EA/D bits\n in a paging-structure entry that is not snooped will result in a non-\n recoverable fault.\"\n\nTo prevent an IOMMU from being incorrectly configured for dirty page\ntracking when it is operating in an incoherent mode, mark SSADS as\nsupported only when both ecap_slads and ecap_smpwc are supported."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\niommu/vt-d: No permitir el seguimiento de páginas modificadas si el recorrido de página es incoherente\n\nEl seguimiento de páginas modificadas depende de que la IOMMU actualice atómicamente el bit de página modificada en la entrada de la estructura de paginación. Para que esta operación tenga éxito, la memoria de la estructura de paginación debe ser coherente entre la IOMMU y la CPU. En otras palabras, si el recorrido de página de la iommu es incoherente, el seguimiento de páginas modificadas no funciona.\n\nLa especificación Intel VT-d, Sección 3.10 'Comportamiento de Snoop' establece:\n\n'El hardware de reasignación que encuentre la necesidad de actualizar atómicamente los bits A/EA/D en una entrada de estructura de paginación que no sea supervisada resultará en una falla no recuperable.'\n\nPara evitar que una IOMMU sea configurada incorrectamente para el seguimiento de páginas modificadas cuando opera en un modo incoherente, marque SSADS como compatible solo cuando tanto ecap_slads como ecap_smpwc sean compatibles."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "drivers/iommu/intel/iommu.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "f35f22cc760eb2c7034bf53251399685d611e03f",
              "lessThan": "ebe16d245a00626bb87163862a1b07daf5475a3e",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "f35f22cc760eb2c7034bf53251399685d611e03f",
              "lessThan": "8d096ce0e87bdc361f0b25d7943543bc53aa0b9e",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "f35f22cc760eb2c7034bf53251399685d611e03f",
              "lessThan": "57f55048e564dedd8a4546d018e29d6bbfff0a7e",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "drivers/iommu/intel/iommu.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "6.7",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "6.7",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.53",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.17.3",
              "lessThanOrEqual": "6.17.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.0,
        "impactScore": 6.0
      }
    ]
  },
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/57f55048e564dedd8a4546d018e29d6bbfff0a7e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/8d096ce0e87bdc361f0b25d7943543bc53aa0b9e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/ebe16d245a00626bb87163862a1b07daf5475a3e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}