The Linux kernel's AMD IOMMU debugfs implementation had a latent out-of-bounds access vulnerability caused by the use of kstrtou32_from_user() to parse user input into int variables dbg_mmio_offset and dbg_cap_offset. Because kstrtou32_from_user() parses unsigned 32-bit integers, large user inputs could wrap into negative signed integers, potentially leading to out-of-bounds memory access. Prior protections included input length limits and range checks, but these were insufficient to prevent all invalid inputs. The fix replaced kstrtou32_from_user() with kstrtos32_from_user() to correctly parse signed integers and added explicit checks for negative values in iommu_mmio_write() and iommu_capability_write(), mitigating the risk of out-of-bounds access.

This vulnerability could allow a local attacker with low privileges to cause out-of-bounds memory access in the AMD IOMMU debugfs interface, potentially leading to denial of service (kernel crash) or other impacts related to memory corruption. The CVSS score of 7.1 reflects high severity with high confidentiality impact and high availability impact, but no integrity impact. There are no known exploits in the wild at this time.

A patch has been applied to the Linux kernel that replaces the unsigned integer parsing function with a signed integer parser and adds explicit checks to prevent negative values, effectively mitigating the vulnerability. Users should update to the fixed kernel version once available. Since this is a kernel-level vulnerability, applying the official kernel update from the vendor or distribution is the recommended remediation. Patch status is not explicitly stated in the input data; check the vendor advisory for current remediation guidance.