Joerg Roedel

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to the I/O page fault handler in the Linux kernel, which currently locates the PCI device by calling `pci get domain bus and slot()`. This function searches the list of all PCI devices until the desired device is found. To improve lookup efficiency, it is replaced with `device rbtree find()` to search the device within the probed device rbtree. The I/O page fault is initiated by the device, which does not have any synchronization mechanism with the software to ensure that the device stays in the probed device tree. Theoretically, a device could be released by the IOMMU subsystem after `device rbtree find()` and before `iopf get dev fault param()`, which would cause a use-after-free problem. A mutex is added to synchronize the I/O page fault reporting path and the IOMMU release device path. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 5.10.45/5.12.12 **Description** The issue arises when memory marked as EFI boot services data is not properly mapped as encrypted under SEV, potentially leading to a kernel crash at boot. This occurs because some drivers require memory to be preserved after ExitBootServices() by inserting a new EFI memory descriptor and marking it with the EFI MEMORY RUNTIME attribute. The kernel needs to map this memory encrypted to prevent crashes. The ` ioremap check other()` function has been expanded to check for this type of boot data reserved at runtime and indicate that it should be mapped encrypted for an SEV guest. **Recommendations** To resolve the issue, upgrade the Linux kernel to a version newer than 5.10.45/5.12.12. This upgrade will include the necessary changes to the ` ioremap check other()` function to properly handle EFI-reserved memory under SEV, preventing potential kernel crashes at boot.