CVE-2025-39961: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-39961 is a race condition vulnerability in the AMD IOMMU host page table implementation of the Linux kernel, specifically in the iommu/amd/pgtbl subsystem. It affects Linux kernel versions from 4.14.146 through 6.16.8, 5.2.17 through 5.3.0-rc8, 5.3.1 through 6.6.107, 6.7 through 6.12.48, and 6.13 through 6.16.8, as well as Microsoft Azure Linux 3 kernel 6.6.96.2-2. The vulnerability was published on October 9, 2025, and has a CVSS v3.1 base score of 4.7 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a race condition (CWE-362) in the AMD IOMMU driver's page table level management. The AMD IOMMU supports dynamic page table levels (up to 6), starting at 3 levels and expanding as IOVA address space grows from 32-bit to 64-bit. The vulnerability arises because the unmap path (iommu_v1_unmap_pages() → fetch_pte()) reads pgtable->[root/mode] without holding a lock, while increase_address_space() on another CPU may simultaneously update these fields under a spinlock. In the race window, fetch_pte() can read the new root pointer but the old mode value, causing a mismatch with the level encoded in the page table, resulting in a NULL return and failed unmap operation. The fix implements seqcount-based synchronization to enable lock-free reads on the unmap path while keeping page table level updates protected by the existing spinlock (Red Hat Bugzilla).

Successful exploitation causes IOMMU unmap operations to fail, leading to denial-of-service conditions through failed I/O operations, kernel WARN_ON log entries, and repeated retry attempts by upper layers. The impact is limited to availability (no confidentiality or integrity impact), and is most significant on systems that heavily utilize AMD IOMMU for DMA operations — particularly virtualized environments, systems with complex I/O configurations, and workloads that exhaust 32-bit IOVA space and trigger address space expansion (Red Hat Advisory).

Exploitation requires local access with low privileges and high attack complexity, as the race condition must be triggered during the narrow window when increase_address_space() is updating page table state concurrently with an unmap operation. There is no known public proof-of-concept exploit, no evidence of in-the-wild exploitation, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.023% (0.000230), reflecting very low probability of exploitation in the near term (Red Hat Advisory).

• Logs: Kernel log entries containing WARN_ON or error messages from the AMD IOMMU subsystem related to iommu_v1_unmap_pages() or fetch_pte() returning NULL unexpectedly.
• Logs: Repeated IOMMU unmap failure messages or retry attempts logged in /var/log/kern.log or via dmesg, particularly on systems with AMD IOMMU hardware under heavy DMA load.
• Process/System Behavior: Unusual I/O failures or hangs in processes performing heavy DMA operations on systems with AMD IOMMU enabled, especially when IOVA address space transitions from 32-bit to 64-bit.

Apply the upstream Linux kernel patches addressing this vulnerability via the following commits: 075abf0b1a958acfbea2435003d228e738e90346, 1e56310b40fd2e7e0b9493da9ff488af145bdd0c, 7d462bdecb7d9c32934dab44aaeb7ea7d73a27a2, and cd92c8ab336c3a633d46e6f35ebcd3509ae7db3b (git.kernel.org). Fixed kernel versions include 6.6.108+, 6.12.49+, and 6.16.9+. For systems that cannot be immediately patched, limit concurrent IOMMU-intensive workloads and monitor system logs for IOMMU unmap failures or related kernel warnings. Prioritize patching systems running AMD IOMMU hardware in virtualized or high-DMA-throughput environments (Red Hat Bugzilla).

The vulnerability was included in coverage of Microsoft's October 2025 Patch Tuesday, which addressed 172 flaws including 6 zero-days, with CVE-2025-39961 noted in the context of the Azure Linux kernel update. Coverage appeared in security outlets including BleepingComputer and various regional security news sources, though the vulnerability itself received no notable independent commentary given its medium severity and limited exploitability.