Linux Kernel CVE-2026-98002

Requires local access on an AMD host with the IOMMU nested-translation path in use (iommufd/vIOMMU allocating a nested domain via amd_iommu_alloc_domain_nested), so the caller must hold privilege to create IOMMU domains (PR:L). The bug ONLY triggers on the error path: amd_iommu_pdom_id_alloc() must actually FAIL, meaning the IOMMU domain-ID space is exhausted or memory allocation is short (ida_alloc_range returns -ENOSPC/-ENOMEM) - under normal successful allocation the code behaves correctly. Limiting factors: AMD-only IOMMU, a recent (7.x) nested-domain feature, no remote reachability, and the need to force an allocation-failure condition that is not directly attacker-controllable, making reliable exploitation hard (AC:H).

This is a genuine but low-real-world-risk kernel error-handling bug, and the input signals are internally inconsistent. NVD assigns 7.8 (High) with a fully-local vector (AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H), yet the description describes an ineffective error check in AMD IOMMU nested-domain allocation that only manifests when amd_iommu_pdom_id_alloc() FAILS - i.e., when the domain-ID space is exhausted or the system is under memory pressure. That is not a directly attacker-triggerable condition, which is consistent with the AC:H rating but undercuts the C:H/I:H full-triad impact. There is NO EPSS score, NO CISA KEV listing, and NO public exploit - so exploitation status is: no public exploit identified at time of analysis. The description makes no claim of information disclosure, privilege escalation, or data leak; the concrete effect is a nested domain configured with a host domain ID that was never allocated (potentially domain-ID 0 / a colliding ID), which realistically produces IOMMU misconfiguration, corruption, or crash rather than confirmed disclosure. Net: the CVSS C:H/I:H/S:C is overstated for an OOM/ID-exhaustion-gated operator/config path; treat this as a low-priority hardening fix, not an urgent threat. The 'Information Disclosure' tag is not supported by the description (a cross-domain DMA leak is only a theoretical downstream possibility, not stated).

A local principal with the ability to create nested IOMMU domains (via iommufd/vIOMMU on an AMD host, e.g. a VMM configuring guest DMA translation) drives the host to exhaust the IOMMU domain-ID space or induces memory pressure so amd_iommu_pdom_id_alloc() returns -ENOSPC. Because the negative errno is stored in a u32 before the '<= 0' check, the failure is silently ignored and the nested domain is set up with an invalid/unallocated host domain ID, leading to IOMMU misconfiguration and likely corruption or a crash. No public proof-of-concept exists, and the required allocation-failure state makes reliable triggering difficult (AC:H).