---
id: CVE-2025-71122
title: 'iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED

  syzkaller found it could overflow math in the test infrastructure and
  cause a WARN_ON by corrupting …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= f4b20bb34c83dceade5470288f48f94ce3598ada <
    4cc829d61f10c20523fd4085c1546e741a792a97
  - >-
    Linux >= f4b20bb34c83dceade5470288f48f94ce3598ada <
    e6c122cffcbb2e84d321ec8ba0e38ce8e7c10925
  - >-
    Linux >= f4b20bb34c83dceade5470288f48f94ce3598ada <
    b166b8e0a381429fefd9180e67fbc834b3cee82f
  - >-
    Linux >= f4b20bb34c83dceade5470288f48f94ce3598ada <
    e6a973af11135439de32ece3b9cbe3bfc043bea8
  - Linux 6.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T21:14:27.670652Z'
published: '2026-01-14'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:23:08.986Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-71122'
references:
  - url: 'https://git.kernel.org/stable/c/4cc829d61f10c20523fd4085c1546e741a792a97'
  - url: 'https://git.kernel.org/stable/c/e6c122cffcbb2e84d321ec8ba0e38ce8e7c10925'
  - url: 'https://git.kernel.org/stable/c/b166b8e0a381429fefd9180e67fbc834b3cee82f'
  - url: 'https://git.kernel.org/stable/c/e6a973af11135439de32ece3b9cbe3bfc043bea8'
tags:
  - cve.org
epss: 0.00217
epssPercentile: 0.12296
ingestedAt: '2026-11-05T22:38:32.051Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED

syzkaller found it could overflow math in the test infrastructure and
cause a WARN_ON by corrupting the reserved interval tree. This only
effects test kernels with CONFIG_IOMMUFD_TEST.

Validate the user input length in the test ioctl.

## Affected

- `Linux >= f4b20bb34c83dceade5470288f48f94ce3598ada < 4cc829d61f10c20523fd4085c1546e741a792a97`
- `Linux >= f4b20bb34c83dceade5470288f48f94ce3598ada < e6c122cffcbb2e84d321ec8ba0e38ce8e7c10925`
- `Linux >= f4b20bb34c83dceade5470288f48f94ce3598ada < b166b8e0a381429fefd9180e67fbc834b3cee82f`
- `Linux >= f4b20bb34c83dceade5470288f48f94ce3598ada < e6a973af11135439de32ece3b9cbe3bfc043bea8`
- `Linux 6.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.