Description
In the Linux kernel, the following vulnerability has been resolved:
iommufd: Break the loop on failure in iommufd_fault_fops_read()
On a copy_to_user() failure inside the inner list_for_each_entry, only the inner loop breaks; the outer while re-fetches the just-restored fault group and retries the failing copy_to_user() forever, spinning the reader at 100% CPU with fault->mutex held.
Check rc after the inner loop and break the outer while as well.
Metrics
CVSS 3.1 5.5/10
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | >= 07838f7fd529c8a6de44b601d4b7057e6c8d36ed, < a38e0714affc5c0bbb40cba5a65d6d32a5e72a71; >= 07838f7fd529c8a6de44b601d4b7057e6c8d36ed, < 5539da127d03c1f6c2e2a49fdfbe331a0ccbdea8; >= 07838f7fd529c8a6de44b601d4b7057e6c8d36ed, < f66c16b175509642ee7082df57c9bf3deaebae1a; >= 07838f7fd529c8a6de44b601d4b7057e6c8d36ed, < 172fc8b19825a0f5884c38f2289188284e2d45ee |
| Linux | Linux | 6.11 |
References
- https://git.kernel.org/stable/c/172fc8b19825a0f5884c38f2289188284e2d45eePatch
- https://git.kernel.org/stable/c/5539da127d03c1f6c2e2a49fdfbe331a0ccbdea8Patch
- https://git.kernel.org/stable/c/a38e0714affc5c0bbb40cba5a65d6d32a5e72a71Patch
- https://git.kernel.org/stable/c/f66c16b175509642ee7082df57c9bf3deaebae1aPatch
Timeline
- Published
- Jul 25, 2026
- Last modified
- Nov 6, 2026
- NVD status
- Analyzed