CVE-2026-98002

Overview

A Linux kernel AMD IOMMU driver error-handling flaw can miss a failed nested domain ID allocation because a negative errno is stored in an unsigned 32-bit field. The driver may then initialize a nested domain with an invalid host domain ID instead of failing cleanly. This matters because it can weaken IOMMU isolation on affected AMD systems.

Description

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix ineffective error check in nested domain allocation amd_iommu_pdom_id_alloc() returns an int: a domain ID on success, or the negative errno from ida_alloc_range() when the ID space is exhausted or memory is short. amd_iommu_alloc_domain_nested() stores that return value in gdom_info->hdom_id, which is a u32, and only then tests it: gdom_info->hdom_id = amd_iommu_pdom_id_alloc(); if (gdom_info->hdom_id <= 0) { The assignment discards the sign, so -ENOSPC becomes 0xffffffe4 and the test never fires. The nested domain is then set up with a host domain ID that was never allocated, instead of the allocation failing with -ENOSPC. Keep the value in an int, test it there, and store it only once it is known to be valid, which is what the other amd_iommu_pdom_id_alloc() callers already do.

Impact

Confidentiality and integrity can be affected if an AMD IOMMU nested domain is configured with an unallocated host domain ID after an allocation failure is missed. Availability may be affected by incorrect IOMMU state, device mapping errors, or kernel instability. Impact is primarily on Linux systems using AMD IOMMU nested domains, such as virtualization or device-assignment workloads.

Remediation

Apply the vendor or distribution kernel update that fixes amd_iommu_alloc_domain_nested() to validate the int return value before storing it in the u32 hdom_id field. If patching is delayed, reduce exposure by disabling or avoiding AMD IOMMU nested-domain features and limiting direct device assignment where feasible. After patching, reboot affected hosts and verify kernel version and IOMMU logs for allocation errors.

Risk context

CVSS v3 7.8 (high) indicates a serious local kernel defect; no EPSS score is provided. Defenders should treat this as a high-priority kernel patch for affected AMD IOMMU Linux systems, particularly those running virtualization or device assignment.

Affected products

• Linux kernel
• AMD IOMMU
• AMD-Vi
• Linux AMD IOMMU driver