Описание
In the Linux kernel, the following vulnerability has been resolved:
iommu/amd: Fix pci device refcount leak in ppr_notifier()
As comment of pci_get_domain_bus_and_slot() says, it returns
a pci device with refcount increment, when finish using it,
the caller must decrement the reference count by calling
pci_dev_put(). So call it before returning from ppr_notifier()
to avoid refcount leak.
A reference counting violation was found in the Linux kernel's AMD IOMMU PPR (Peripheral Page Request) notification handler. When the handler looks up PCI devices using pci_get_domain_bus_and_slot, it receives a reference-counted device pointer but never releases that reference before returning. This creates permanent reference leaks that prevent proper device cleanup, eventually exhausting system resources and causing denial of service.
Отчет
The PPR notifier handles page fault requests from IOMMU-managed devices. As documented in the PCI subsystem, pci_get_domain_bus_and_slot increments the reference count on the returned device—this is intentional, ensuring the device doesn't disappear while being used. The caller's responsibility is to decrement that count via pci_dev_put when finished. The ppr_notifier function calls pci_get_domain_bus_and_slot to locate the faulting device, processes the fault, then returns without ever calling pci_dev_put. Each invocation therefore leaks one reference. Over time, these leaked references accumulate on the affected devices. Once a device has outstanding references, the system cannot fully release it even when physically removed or when the driver unloads. Eventually this can exhaust kernel object limits or create situations where stale device objects persist indefinitely. The issue affects AMD IOMMU systems when PPR is enabled.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Not affected | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix pci device refcount leak in ppr_notifier() As comment of pci_get_domain_bus_and_slot() says, it returns a pci device with refcount increment, when finish using it, the caller must decrement the reference count by calling pci_dev_put(). So call it before returning from ppr_notifier() to avoid refcount leak.
In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix pci device refcount leak in ppr_notifier() As comment of pci_get_domain_bus_and_slot() says, it returns a pci device with refcount increment, when finish using it, the caller must decrement the reference count by calling pci_dev_put(). So call it before returning from ppr_notifier() to avoid refcount leak.
In the Linux kernel, the following vulnerability has been resolved: i ...
In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix pci device refcount leak in ppr_notifier() As comment of pci_get_domain_bus_and_slot() says, it returns a pci device with refcount increment, when finish using it, the caller must decrement the reference count by calling pci_dev_put(). So call it before returning from ppr_notifier() to avoid refcount leak.
Уязвимость функции ppr_notifier() модуля drivers/iommu/amd/iommu_v2.c драйвера IOMMU ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании
EPSS
5.5 Medium
CVSS3