Linux Kernel CVE-2025-39961

Exploitation requires: (1) local authenticated access to the target system (CVSS AV:L/PR:L); (2) AMD IOMMU hardware present and enabled (amd_iommu=on or default on AMD platforms); (3) the ability to trigger IOVA address space expansion, which occurs when 32-bit IOVA space is exhausted - this requires a process capable of issuing sustained DMA-intensive operations (e.g., via a PCI device driver or DMA-capable userspace interface); (4) concurrent execution of IOMMU unmap operations on a separate CPU during the expansion window, requiring multi-core hardware. The race window is extremely narrow (between two sequential writes in increase_address_space()), establishing the AC:H rating. Systems without AMD IOMMU hardware, systems with AMD IOMMU disabled via kernel parameters (amd_iommu=off or iommu=off), and systems without concurrent DMA workloads are not affected. Authentication requirements confirmed by CVSS PR:L.

The CVSS 3.1 base score of 4.7 with vector AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H accurately characterizes the risk: exploitation requires local system access, a low-privilege account, and high attack complexity due to the narrow timing window that only opens during the infrequent IOVA address space expansion event. EPSS at 0.10% (1st percentile) confirms minimal exploitation interest from the threat intelligence community, and absence from CISA KEV aligns with this being a reliability-class bug rather than a weaponizable security vulnerability. Impact is limited to availability (A:H) - an attacker successfully triggering the race causes IOMMU unmap failures and WARN_ON kernel logging, but no data is leaked (C:N) and no memory is corrupted (I:N). The practical bar for exploitation is high: an attacker must be local, must be able to time DMA map/unmap operations around the rare IOVA expansion event, and the consequence is a service disruption rather than code execution or data theft. This vulnerability is a real-world priority only for kernel maintainers and distributions shipping AMD IOMMU-enabled kernels; it is not an immediate production incident for most security teams.

A local attacker with a low-privilege shell on a server with AMD IOMMU enabled launches a userspace process that continuously performs DMA-intensive operations to exhaust the 32-bit IOVA allocator and trigger IOVA address space expansion, while a second concurrent thread issues IOMMU unmap operations. At the precise moment increase_address_space() writes the new root pointer but has not yet incremented pgtable->mode, fetch_pte() on the sibling CPU reads the torn state, returns NULL, and the unmap operation fails - causing the kernel to log WARN_ON and potentially disrupting driver-level DMA operations. No public proof-of-concept exploit code has been identified at time of analysis.