{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2025-39961",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2025-39961",
    "idYear": 2025,
    "status": "PUBLISHED",
    "publishedAt": "2025-10-09T12:13:22.029Z",
    "updatedAt": "2026-10-15T22:02:34.065Z",
    "importedAt": "2026-10-24T01:57:34.152Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "iommu/amd/pgtbl: Fix possible race while increase page table level",
      "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/amd/pgtbl: Fix possible race while increase page table level\n\nThe AMD IOMMU host page table implementation supports dynamic page table levels\n(up to 6 levels), starting with a 3-level configuration that expands based on\nIOVA address. The kernel maintains a root pointer and current page table level\nto enable proper page table walks in alloc_pte()/fetch_pte() operations.\n\nThe IOMMU IOVA allocator initially starts with 32-bit address and onces its\nexhuasted it switches to 64-bit address (max address is determined based\non IOMMU and device DMA capability). To support larger IOVA, AMD IOMMU\ndriver increases page table level.\n\nBut in unmap path (iommu_v1_unmap_pages()), fetch_pte() reads\npgtable->[root/mode] without lock. So its possible that in exteme corner case,\nwhen increase_address_space() is updating pgtable->[root/mode], fetch_pte()\nreads wrong page table level (pgtable->mode). It does compare the value with\nlevel encoded in page table and returns NULL. This will result is\niommu_unmap ops to fail and upper layer may retry/log WARN_ON.\n\nCPU 0                                         CPU 1\n------                                       ------\nmap pages                                    unmap pages\nalloc_pte() -> increase_address_space()      iommu_v1_unmap_pages() -> fetch_pte()\n  pgtable->root = pte (new root value)\n                                             READ pgtable->[mode/root]\n\t\t\t\t\t       Reads new root, old mode\n  Updates mode (pgtable->mode += 1)\n\nSince Page table level updates are infrequent and already synchronized with a\nspinlock, implement seqcount to enable lock-free read operations on the read path.",
      "affected": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "754265bcab78a9014f0f99cd35e0d610fcd7dfa7",
              "status": "affected",
              "versionType": "git",
              "lessThan": "075abf0b1a958acfbea2435003d228e738e90346"
            },
            {
              "version": "754265bcab78a9014f0f99cd35e0d610fcd7dfa7",
              "status": "affected",
              "versionType": "git",
              "lessThan": "cd92c8ab336c3a633d46e6f35ebcd3509ae7db3b"
            },
            {
              "version": "754265bcab78a9014f0f99cd35e0d610fcd7dfa7",
              "status": "affected",
              "versionType": "git",
              "lessThan": "7d462bdecb7d9c32934dab44aaeb7ea7d73a27a2"
            },
            {
              "version": "754265bcab78a9014f0f99cd35e0d610fcd7dfa7",
              "status": "affected",
              "versionType": "git",
              "lessThan": "1e56310b40fd2e7e0b9493da9ff488af145bdd0c"
            },
            {
              "version": "6fb92f18555a7b8e085267d513612dc0ff9a5360",
              "status": "affected",
              "versionType": "git"
            },
            {
              "version": "b15bf74405faa1a65025eb8a6eb337e140e5250a",
              "status": "affected",
              "versionType": "git"
            },
            {
              "version": "0d50f7b1e8c80a8c20db5049e269468c059b0378",
              "status": "affected",
              "versionType": "git"
            },
            {
              "version": "785ca708a908b9c596ede852470ba28b8dc3e40b",
              "status": "affected",
              "versionType": "git"
            },
            {
              "version": "4.9.194",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "4.10"
            },
            {
              "version": "4.14.146",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "4.15"
            },
            {
              "version": "4.19.75",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "4.20"
            },
            {
              "version": "5.2.17",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "5.3"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "5.3",
              "status": "affected"
            },
            {
              "version": "0",
              "status": "unaffected",
              "versionType": "semver",
              "lessThan": "5.3"
            },
            {
              "version": "6.6.108",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "version": "6.12.49",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "version": "6.16.9",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.16.*"
            },
            {
              "version": "6.17",
              "status": "unaffected",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ]
        }
      ]
    }
  }
}