CVE-2026-23429
Use-After-Free Vulnerability in Linux Kernel iommu_sva Causes Crash
Publication date: 2026-04-03
Last updated on: 2026-04-27
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | From 6.18.7 (inc) to 6.18.20 (exc) |
| linux | linux_kernel | From 6.19.1 (inc) to 6.19.10 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's iommu/sva component. It involves a crash caused by accessing a freed memory structure. Specifically, after the function iommu_domain_free() is called, the code still tries to access domain->mm->iommu_mm, which may have already been freed. This leads to a dereference of a freed memory structure and causes the system to crash.
The fix involves moving the code that accesses domain->mm->iommu_mm to before the call to iommu_domain_free(), preventing access to freed memory.
How can this vulnerability impact me? :
This vulnerability can cause the Linux kernel to crash due to accessing freed memory. Such crashes can lead to system instability, unexpected reboots, or denial of service conditions, potentially disrupting normal operations on affected systems.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is caused by accessing a freed mm structure after iommu_domain_free() returns, leading to a crash.
To mitigate this vulnerability, ensure that the Linux kernel is updated with the fix that moves the code accessing domain->mm->iommu_mm to before the call to iommu_domain_free().
Applying the official patch or updating to a kernel version that includes this fix is the immediate recommended step.