CVE-2025-71089: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71089 is a Use-After-Free and Write-After-Free vulnerability in the Linux kernel's IOMMU Shared Virtual Addressing (SVA) feature on x86 systems. The flaw arises because the IOMMU hardware caches kernel page table entries, but the kernel lacks a notification mechanism to inform the IOMMU when those page table pages are freed and reallocated. Affected Linux kernel versions span 5.2 through 6.18.3 across multiple stable branches. It was published on January 13, 2026, with patches added to the stable kernel trees by late February 2026. The CVSS v3.1 base score is 7.8 (High) (Feedly, Microsoft MSRC).

The root cause is classified as Use-After-Free (CWE-416) and Write-After-Free, stemming from a missing IOMMU invalidation notification when kernel page table pages are freed and reused. On x86, the kernel's virtual address space is mapped into the upper portion of every process's page table; in an SVA context, the IOMMU hardware walks and caches these kernel page table entries. When a kernel page table page is freed and reallocated for another purpose, the IOMMU's IOTLB (Input/Output Translation Lookaside Buffer) may still hold stale entries pointing to the now-repurposed memory. Additionally, the IOMMU may continue writing Accessed and Dirty bits to freed memory while walking stale page tables, creating a Write-After-Free condition. The fix introduces a deferred freeing mechanism for kernel page table pages, providing a safe window to notify the IOMMU to invalidate its caches before the page is reused (Feedly, kernel patch).

A local attacker with low-level privileges can exploit stale IOTLB entries to gain arbitrary physical memory DMA access, potentially leading to privilege escalation, unauthorized access to kernel memory, and data corruption. The IOMMU may misinterpret freed memory as valid page table entries and continue walking into attacker-controlled memory, enabling full kernel compromise. Confidentiality, integrity, and availability are all rated High, reflecting the potential for complete system takeover on affected x86 Linux systems with SVA-capable IOMMU hardware (Feedly).

Patches are available in the following fixed Linux kernel versions: 5.15.200, 6.1.163, 6.6.120, 6.12.64, and 6.18.4 or later. Multiple distribution vendors have issued updates, including Debian (DSA-6163-1, DLA-4499-1), Ubuntu (USN-8177-1/2, USN-8183-1/2, USN-8245-1, USN-8257-1), Amazon Linux 2 (ALAS2KERNEL-5.15-2026-098/099), and Red Hat (RHSA-2026:21556, RHSA-2026:23237). As an interim workaround where kernel updates cannot be immediately deployed, disable SVA (Shared Virtual Addressing) in IOMMU configurations. Limiting user and administrative privileges also reduces the attack surface (Feedly, Ubuntu USN-8177-1, Red Hat).

The vulnerability has been acknowledged by multiple major Linux distribution vendors including Debian, Ubuntu, Red Hat, and Amazon Linux, all of whom have issued security advisories and kernel updates. No notable independent researcher commentary or significant social media discussion has been identified beyond standard vendor advisory channels (Feedly).