Linux Kernel EUVD-2026-49002

The vulnerability is in the iommufd (IOMMU File Descriptor) subsystem of the Linux kernel, specifically in iommufd_fault_fops_read(), the read file-operation handler for IOMMU fault events. The iommufd subsystem manages DMA remapping through IOMMU hardware and is primarily used in virtualization stacks for VFIO device pass-through. The root cause is CWE-835 (Loop with Unreachable Exit Condition): the function uses nested loops - an outer while and an inner list_for_each_entry - to process fault group entries and copy them to userspace. When copy_to_user() fails inside the inner loop (e.g., due to an invalid or faulting userspace buffer), the inner loop sets rc and breaks, but the outer while loop does not check rc before looping. This causes the outer loop to re-fetch the just-restored fault group and unconditionally retry the same failing copy_to_user() call forever, spinning the reader thread at 100% CPU with fault->mutex continuously held. Affected CPE is cpe:2.3:a:linux:linux:* from the introducing commit 07838f7fd529c8a6de44b601d4b7057e6c8d36ed onward until the respective stable-tree fix commits.