CVE-2024-53225

What it actually does

The flaw allows an invalid max_n_shift value to be passed during command queue initialization, failing alignment checks under 4KB page sizes with certain CMA configurations and triggering a WARN_ON in arm_smmu_init_one_queue.

Why it matters to the business

Affected systems may encounter boot-time warnings or initialization failures on compatible hardware, leading to reduced stability, delayed deployments, or the need for immediate kernel updates in production environments.

How an attack unfolds

An attacker with the ability to control kernel build configuration or boot parameters could trigger the alignment failure during SMMU device probe on Tegra-based systems, though the issue manifests as a warning rather than direct code execution or privilege gain.

How to fix it

Update the Linux kernel to version 6.12.2 or apply commit 85a1d70b86dbcb84a68e7e4942a5181276945988; cap max_n_shift to CMDQ_MAX_SZ_SHIFT in iommu/tegra241-cmdqv code.

How to confirm the fix worked

Confirm updated kernel version boots without the arm_smmu_init_one_queue warning on 4KB page configurations; inspect source for the max_n_shift capping change.

Typical attack path

1. Configure kernel with PAGE_SIZE=4KB and high CONFIG_CMA_ALIGNMENT
2. Boot system triggering tegra241_cmdqv_init_structures during arm-smmu-v3 probe
3. Cause alignment test failure in arm_smmu_init_one_queue resulting in WARN_ON

How to detect it

Search kernel boot logs and dmesg for the WARNING at drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c:3646 and the call trace involving arm_smmu_init_one_queue and tegra241_cmdqv_init_structures.

• WARNING: at drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c:3646
• arm_smmu_init_one_queue+0x15c/0x210
• tegra241_cmdqv_init_structures+0x114/0x338

What your security team should do

• Prioritize kernel upgrade to 6.12.2 or patched commit on all affected systems
• Review and adjust CMA alignment settings where possible to avoid the condition
• Monitor boot logs for the specific SMMU queue initialization warning