CVE-2026-98003

Overview

A Linux kernel AMD IOMMU driver issue can leak GA log buffer allocations and perform unsafe memory allocation during system resume. It matters because repeated suspend/resume cycles on AMD IOMMU systems can exhaust kernel memory or leave stale pointers. The fix avoids reallocating existing GA log buffers and clears pointers on free.

Description

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Do not reallocate GA log buffers on resume Commit c5e1a1eb9279 ("iommu/amd: Simplify and Consolidate Virtual APIC (AVIC) Enablement") moved the GA log allocation from iommu_init_pci() to enable_iommus_vapic(), which is called on every resume. iommu_init_ga_log() assigns iommu->ga_log and iommu->ga_log_tail unconditionally. Each resume therefore replaces the boot-time pointers and leaks both old allocations. The function also uses GFP_KERNEL from a syscore resume callback, where interrupts are disabled and the non-boot CPUs are offline. Return early if both buffers are already allocated. Clear the pointers in free_ga_log() so a partial allocation failure cannot leave ga_log dangling.

Impact

Confidentiality and integrity are not directly indicated; availability is affected by kernel memory leaks and possible stale pointer state during resume. Impacted systems are Linux hosts using AMD IOMMU with AVIC/GA log support that enter suspend/resume. Repeated resume cycles can degrade system stability or lead to denial of service. No remote attacker control is described.

Remediation

Apply vendor kernel updates containing the iommu/amd fix that returns early when GA log buffers are already allocated and clears pointers in free_ga_log(). If patching is delayed, avoid repeated suspend/resume cycles on affected AMD IOMMU hosts where feasible. Monitor kernel memory usage and dmesg for IOMMU/AVIC allocation anomalies after resume. Verify the running kernel includes the commit or backport and restart affected systems after applying updates.

Risk context

Medium severity with CVSS v3 5.5 and no EPSS data; treat as routine kernel hardening. Prioritize for systems that regularly suspend/resume and use AMD IOMMU AVIC/GA log features. No evidence of active exploitation is provided.

Affected products

• Linux kernel
• AMD IOMMU
• AMD IOMMU AVIC
• Linux iommu/amd driver