CVE-2026-98003

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98003", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:19:56.068Z", "datePublished": "2026-09-25T10:23:30.522Z", "dateUpdated": "2026-10-21T12:54:02.989Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:54:02.989Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/amd: Do not reallocate GA log buffers on resume\n\nCommit c5e1a1eb9279 (\"iommu/amd: Simplify and Consolidate Virtual APIC\n(AVIC) Enablement\") moved the GA log allocation from iommu_init_pci()\nto enable_iommus_vapic(), which is called on every resume.\n\niommu_init_ga_log() assigns iommu->ga_log and iommu->ga_log_tail\nunconditionally. Each resume therefore replaces the boot-time pointers\nand leaks both old allocations. The function also uses GFP_KERNEL from a\nsyscore resume callback, where interrupts are disabled and the non-boot\nCPUs are offline.\n\nReturn early if both buffers are already allocated. Clear the pointers\nin free_ga_log() so a partial allocation failure cannot leave ga_log\ndangling."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/iommu/amd/init.c"], "versions": [{"version": "c5e1a1eb9279fdb28d47ca2a4493a4c53b7d6a0b", "lessThan": "8b95269d7a43b737c2c0e2fa77bf00cc8a3a4434", "status": "affected", "versionType": "git"}, {"version": "c5e1a1eb9279fdb28d47ca2a4493a4c53b7d6a0b", "lessThan": "ff85cdc2889e1c885eed218ee5bc0b59e0235b3f", "status": "affected", "versionType": "git"}, {"version": "c5e1a1eb9279fdb28d47ca2a4493a4c53b7d6a0b", "lessThan": "94458b80d3b203c1c9e2c98aa7319b7713e006c0", "status": "affected", "versionType": "git"}, {"version": "c5e1a1eb9279fdb28d47ca2a4493a4c53b7d6a0b", "lessThan": "b6be275d19cee01f8f1f08a2ff18337103d05d40", "status": "affected", "versionType": "git"}, {"version": "c5e1a1eb9279fdb28d47ca2a4493a4c53b7d6a0b", "lessThan": "00a7dd64888d6dd72110b40e2824a088cf7b7386", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/iommu/amd/init.c"], "versions": [{"version": "6.0", "status": "affected"}, {"version": "0", "lessThan": "6.0", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.114", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.12.114"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/8b95269d7a43b737c2c0e2fa77bf00cc8a3a4434"}, {"url": "https://git.kernel.org/stable/c/ff85cdc2889e1c885eed218ee5bc0b59e0235b3f"}, {"url": "https://git.kernel.org/stable/c/94458b80d3b203c1c9e2c98aa7319b7713e006c0"}, {"url": "https://git.kernel.org/stable/c/b6be275d19cee01f8f1f08a2ff18337103d05d40"}, {"url": "https://git.kernel.org/stable/c/00a7dd64888d6dd72110b40e2824a088cf7b7386"}], "title": "iommu/amd: Do not reallocate GA log buffers on resume", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/iommu/amd/init.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "8b95269d7a43b737c2c0e2fa77bf00cc8a3a4434", "status": "affected", "version": "c5e1a1eb9279fdb28d47ca2a4493a4c53b7d6a0b", "versionType": "git"}, {"lessThan": "ff85cdc2889e1c885eed218ee5bc0b59e0235b3f", "status": "affected", "version": "c5e1a1eb9279fdb28d47ca2a4493a4c53b7d6a0b", "versionType": "git"}, {"lessThan": "94458b80d3b203c1c9e2c98aa7319b7713e006c0", "status": "affected", "version": "c5e1a1eb9279fdb28d47ca2a4493a4c53b7d6a0b", "versionType": "git"}, {"lessThan": "b6be275d19cee01f8f1f08a2ff18337103d05d40", "status": "affected", "version": "c5e1a1eb9279fdb28d47ca2a4493a4c53b7d6a0b", "versionType": "git"}, {"lessThan": "00a7dd64888d6dd72110b40e2824a088cf7b7386", "status": "affected", "version": "c5e1a1eb9279fdb28d47ca2a4493a4c53b7d6a0b", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/iommu/amd/init.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.0"}, {"lessThan": "6.0", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.114", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/amd: Do not reallocate GA log buffers on resume\n\nCommit c5e1a1eb9279 (\"iommu/amd: Simplify and Consolidate Virtual APIC\n(AVIC) Enablement\") moved the GA log allocation from iommu_init_pci()\nto enable_iommus_vapic(), which is called on every resume.\n\niommu_init_ga_log() assigns iommu->ga_log and iommu->ga_log_tail\nunconditionally. Each resume therefore replaces the boot-time pointers\nand leaks both old allocations. The function also uses GFP_KERNEL from a\nsyscore resume callback, where interrupts are disabled and the non-boot\nCPUs are offline.\n\nReturn early if both buffers are already allocated. Clear the pointers\nin free_ga_log() so a partial allocation failure cannot leave ga_log\ndangling."}], "id": "CVE-2026-98003", "lastModified": "2026-10-21T13:21:19.073", "metrics": {}, "published": "2026-09-25T11:17:28.533", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/00a7dd64888d6dd72110b40e2824a088cf7b7386"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8b95269d7a43b737c2c0e2fa77bf00cc8a3a4434"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/94458b80d3b203c1c9e2c98aa7319b7713e006c0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b6be275d19cee01f8f1f08a2ff18337103d05d40"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ff85cdc2889e1c885eed218ee5bc0b59e0235b3f"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: iommu/amd: Do not reallocate GA log buffers on resume", "id": "2541117", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541117"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-772", "details": ["In the Linux kernel, the following vulnerability has been resolved:\niommu/amd: Do not reallocate GA log buffers on resume\nCommit c5e1a1eb9279 (\"iommu/amd: Simplify and Consolidate Virtual APIC\n(AVIC) Enablement\") moved the GA log allocation from iommu_init_pci()\nto enable_iommus_vapic(), which is called on every resume.\niommu_init_ga_log() assigns iommu->ga_log and iommu->ga_log_tail\nunconditionally. Each resume therefore replaces the boot-time pointers\nand leaks both old allocations. The function also uses GFP_KERNEL from a\nsyscore resume callback, where interrupts are disabled and the non-boot\nCPUs are offline.\nReturn early if both buffers are already allocated. Clear the pointers\nin free_ga_log() so a partial allocation failure cannot leave ga_log\ndangling.", "A flaw was found in the Linux kernel's AMD Input-Output Memory Management Unit (IOMMU) driver. When the system resumes from sleep, the driver reallocates internal logging buffers without releasing previously allocated memory and performs memory requests in an invalid context. A local user with power management privileges could trigger repeated suspend and resume cycles, resulting in a memory leak and a potential Denial of Service (DoS) from kernel instability or crashes."], "name": "CVE-2026-98003", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98003\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98003\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98003.mbox"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c5e1a1eb9279fdb28d47ca2a4493a4c53b7d6a0b,94458b80d3b203c1c9e2c98aa7319b7713e006c0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c5e1a1eb9279fdb28d47ca2a4493a4c53b7d6a0b,b6be275d19cee01f8f1f08a2ff18337103d05d40)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c5e1a1eb9279fdb28d47ca2a4493a4c53b7d6a0b,00a7dd64888d6dd72110b40e2824a088cf7b7386)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.0"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.7,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T15:30:06.907531+00:00", "updated": "2026-10-01T02:00:15.519941+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}