IOMMU Alignment Overflow Vulnerability in Linux Kernel Package
Summary
DEBIAN-CVE-2025-38688: In the Linux kernel, the following vulnerability has been resolved: iommufd: Prevent ALIGN() overflow When allocating IOVA the candidate range gets aligned to the target alignment. Affects linux versions < 6.12.43-1. Fixed in 6.12.43-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to software applications. It is widely used across various distributions, including Debian. The kernel's functionality includes process management, memory management, device drivers, and system calls. This vulnerability specifically affects the IOMMU (Input-Output Memory Management Unit) subsystem, which is crucial for managing memory access for devices in a secure manner.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the IOMMU subsystem related to the ALIGN() function. When allocating IOVA (I/O Virtual Address), the candidate range is aligned to the target alignment. If this range approaches ULONG_MAX, the ALIGN() function can overflow, leading to a corrupted IOVA. This bug allows userspace applications to create mappings that may overlap with other mappings or reserved ranges, potentially leading to unauthorized access or system instability.
How To Fix
Minimum fixed version
6.12.43-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds are provided for this vulnerability. It is recommended to apply the patch as soon as it is available to mitigate any risks associated with this issue.
Conclusion
The IOMMU alignment overflow vulnerability in the Linux kernel poses significant risks to system integrity and security. Users are strongly advised to update their kernel packages to the latest patched versions to mitigate these risks. Regular monitoring for vulnerabilities using tools like Vulert can help maintain system security.
See every vulnerability recorded for linux →
FAQ
The vulnerability is an overflow issue in the ALIGN() function used in the IOMMU subsystem of the Linux kernel, which can lead to corrupted memory mappings.
Exploitation of this vulnerability may allow userspace applications to create overlapping memory mappings, potentially leading to unauthorized access to memory or system instability.
If you are using Debian 13 or 14 with the specified versions of the Linux kernel, your system may be affected. You can check for vulnerabilities using Vulert's playground without needing to install any software.
You can update your Linux kernel by running 'sudo apt update' followed by 'sudo apt upgrade linux' in your terminal.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in your software using a manifest file like package-lock.json. You can check if your application is affected by this vulnerability using Vulert's playground.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
