CVE-2026-98003

CVE-2026-98003

published September 25, 2026

CVSS
—
EPSS
0%
Percentile
5.7
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

iommu/amd: Do not reallocate GA log buffers on resume

Commit c5e1a1eb9279 ("iommu/amd: Simplify and Consolidate Virtual APIC

(AVIC) Enablement") moved the GA log allocation from iommu_init_pci()

to enable_iommus_vapic(), which is called on every resume.

iommu_init_ga_log() assigns iommu->ga_log and iommu->ga_log_tail

unconditionally. Each resume therefore replaces the boot-time pointers

and leaks both old allocations. The function also uses GFP_KERNEL from a

syscore resume callback, where interrupts are disabled and the non-boot

CPUs are offline.

Return early if both buffers are already allocated. Clear the pointers

in free_ga_log() so a partial allocation failure cannot leave ga_log

dangling.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00168 · 5.7th percentile
Published
2026-09-25T15:17Z
References (5)
EPSS history
Timeline
  • 27 SEP 03:28Z
    EPSS moved — → 0%
    epss
  • 25 SEP 10:23Z
    iommu/amd: Do not reallocate GA log buffers on resume
    cvelistv5