Linux iommu/amd - race while increasing host page table level: The AMD IOMMU host page table implementation supports

Impact

The AMD IOMMU host page table implementation supports growing the page table dynamically, and the code that increases the level races with concurrent users. At CVSS 8.8 this is the most severe AMD IOMMU issue in the set. The AMD IOMMU is what constrains device DMA on a GPU host - it is the boundary that stops a passed-through or SR-IOV accelerator from reading memory belonging to another tenant - so a race that corrupts its page tables is a direct threat to device-level isolation, and a corruption primitive in host kernel memory besides.

Who can reach it

Local, triggered by concurrent DMA mapping activity. On a GPU node with high-rate accelerator and RDMA NIC DMA, the concurrency needed to hit this arises from normal workload behaviour, and a tenant can drive it deliberately by hammering mapping operations.

What to do

Fixed in the Linux kernel AMD IOMMU driver. Take the distro kernel update and reboot the host - no firmware, VBIOS or AGESA step. Prioritise this on nodes doing GPU passthrough, SR-IOV or heavy RDMA: those are the configurations that exercise the dynamic page-table growth path hardest and depend most on IOMMU correctness for tenant isolation.

References