CVE-2025-39939: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-39939 is a vulnerability discovered in the Linux kernel affecting the IOMMU subsystem on s390 architecture. The issue was identified on October 4, 2025, and involves memory corruption when using identity domain. The vulnerability specifically affects the zpcigetiommu_ctrs() function which handles counter information for device statistics (NVD, Ubuntu).

The vulnerability occurs when zpcigetiommuctrs() attempts to return counter information for device statistics. The core issue lies in the identity domain not being backed by an s390domain, causing the tos390domain() conversion to yield an invalid address. This address is initially zeroed and later accessed during sysfs read operations. The issue was discovered through KASAN (Kernel Address Sanitizer) which reported global-out-of-bounds access in zpcifmbenable_device when using the identity domain for a device on s390 (NVD).

The vulnerability can lead to memory corruption in the Linux kernel when using the identity domain on s390 systems. This could potentially affect system stability and security on affected systems (NVD).

The fix involves modifying the zpcigetiommu_ctrs() function to return NULL when dealing with the identity domain, as these counters are not necessary in this context (NVD).