{"id":"CVE-2025-38688","title":"iommufd: Prevent ALIGN() overflow","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\niommufd: Prevent ALIGN() overflow\n\nWhen allocating IOVA the candidate range gets aligned to the target\nalignment. If the range is close to ULONG_MAX then the ALIGN() ca…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 51fe6141f0f64ae0bbc096a41a07572273e8c0ef < d19b817540c0abe84854a64ee9ee34cecc3bbeef","Linux >= 51fe6141f0f64ae0bbc096a41a07572273e8c0ef < ebb6021560b94649bec6b8faba6fe0dca2218e81","Linux >= 51fe6141f0f64ae0bbc096a41a07572273e8c0ef < e42a046bb41dcdde4f766a17d8211842007ed537","Linux >= 51fe6141f0f64ae0bbc096a41a07572273e8c0ef < 79fad1917802c28de51a479318a056a6fbe3e2f2","Linux >= 51fe6141f0f64ae0bbc096a41a07572273e8c0ef < b42497e3c0e74db061eafad41c0cd7243c46436b","Linux 6.2"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-15T21:52:48.832507Z"},"published":"2025-09-04","updated":"2026-10-15","sourceUpdated":"2026-10-15T22:02:28.092Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-38688","references":[{"url":"https://git.kernel.org/stable/c/d19b817540c0abe84854a64ee9ee34cecc3bbeef"},{"url":"https://git.kernel.org/stable/c/ebb6021560b94649bec6b8faba6fe0dca2218e81"},{"url":"https://git.kernel.org/stable/c/e42a046bb41dcdde4f766a17d8211842007ed537"},{"url":"https://git.kernel.org/stable/c/79fad1917802c28de51a479318a056a6fbe3e2f2"},{"url":"https://git.kernel.org/stable/c/b42497e3c0e74db061eafad41c0cd7243c46436b"}],"tags":["cve.org"],"epss":0.00169,"epssPercentile":0.06247,"ingestedAt":"2026-10-15T22:48:25.517Z","slug":"CVE-2025-38688","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niommufd: Prevent ALIGN() overflow\n\nWhen allocating IOVA the candidate range gets aligned to the target\nalignment. If the range is close to ULONG_MAX then the ALIGN() can\nwrap resulting in a corrupted iova.\n\nOpen code the ALIGN() using get_add_overflow() to prevent this.\nThis simplifies the checks as we don't need to check for length earlier\neither.\n\nConsolidate the two copies of this code under a single helper.\n\nThis bug would allow userspace to create a mapping that overlaps with some\nother mapping or a reserved range.\n\n## Affected\n\n- `Linux >= 51fe6141f0f64ae0bbc096a41a07572273e8c0ef < d19b817540c0abe84854a64ee9ee34cecc3bbeef`\n- `Linux >= 51fe6141f0f64ae0bbc096a41a07572273e8c0ef < ebb6021560b94649bec6b8faba6fe0dca2218e81`\n- `Linux >= 51fe6141f0f64ae0bbc096a41a07572273e8c0ef < e42a046bb41dcdde4f766a17d8211842007ed537`\n- `Linux >= 51fe6141f0f64ae0bbc096a41a07572273e8c0ef < 79fad1917802c28de51a479318a056a6fbe3e2f2`\n- `Linux >= 51fe6141f0f64ae0bbc096a41a07572273e8c0ef < b42497e3c0e74db061eafad41c0cd7243c46436b`\n- `Linux 6.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}