CVE-2025-40293

What it actually does

Division-by-zero in iommufd dirty-tracking bitmap index calculation when pgshift equals 63, caused by 64-bit multiplication overflow to zero before the division.

Why it matters to the business

Kernel panic or denial-of-service on Linux systems performing IOMMU dirty-page tracking with extreme page-shift values, disrupting virtualization, device passthrough, and container workloads.

How an attack unfolds

An attacker with local access crafts IOMMU operations or VFIO/iommufd user-space calls that force pgshift=63 during bitmap sizing, triggering the overflow path and immediate divide-by-zero fault in kernel context.

How to fix it

Upgrade the Linux kernel to the commit 07105e61882ff4a7d58db63cc5f9e90c6c60506c or later stable releases that reorganize the index calculation to divide by shift and avoid overflow.

How to confirm the fix worked

Verify the running kernel contains commit 07105e61882ff4a7d58db63cc5f9e90c6c60506c; attempt to reproduce the pgshift=63 bitmap allocation path in a test environment and confirm absence of divide-by-zero fault.

Typical attack path

1. Obtain local unprivileged or container access on a vulnerable Linux kernel
2. Invoke iommufd or VFIO APIs that allocate dirty-tracking bitmaps with pgshift set to 63
3. Trigger the BITS_PER_TYPE multiplication that overflows to zero
4. Execute the subsequent division, causing kernel oops and system crash or reboot

How to detect it

Search kernel logs (dmesg, journalctl) and crash dumps for divide-by-zero faults or oops originating from iommufd dirty-tracking bitmap code; correlate with processes performing VFIO or IOMMU operations.

• divide error: 0000 [#1] SMP
• RIP: 0010:iommufd.*dirty
• BUG: unable to handle kernel paging request at
• kernel BUG at drivers/iommu/iommufd

What your security team should do

• Patch all affected kernels to the fixed commit within the next maintenance window
• Prioritize systems running virtualization or device-assignment workloads that use iommufd
• Monitor kernel logs for unexpected oops or divide-by-zero faults until patching is complete