CVE-2026-80894

Received Received - Intake

iommufd Parameter Mismatch in hwpt Replace Operation

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace iommufd_hwpt_replace_device() calls: iommufd_auto_response_faults(hwpt, old_handle); passing the *new* hwpt together with the handle of the device's *old* domain. This should be a parameter mismatch: 1. Semantically, iommufd_auto_response_faults(x, handle) scans x->fault's deliver list and response xarray for groups matching "handle". A group is queued under the hwpt that was attached at fault-delivery time. old_handle is fetched *before* the domain switch, so its group lives on old->fault, not on the new hwpt->fault. 2. Historically, the first argument was "old". The routine was introduced by commit b7d8833677ba ("iommufd: Fault-capable hwpt attach/detach/replace") as __fault_domain_replace_dev() in fault.c, correctly calling iommufd_auto_response_faults(old, curr). Commit fb21b1568ada ("iommufd: Make attach_handle generic than fault specific") moved this into iommufd_hwpt_replace_device() in device.c and swapped it to "hwpt". This should be a refactor regression, not an intentional change. Fix this by passing "old" instead.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-04

Last Modified

2026-09-04

Generated

2026-09-05

AI Q&A

2026-09-05

EPSS Evaluated

N/A

NVD

CVE-2026-80894

EUVD

EUVD-2026-71644

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's iommufd component. It involves a bug where the wrong hardware page table (hwpt) is passed during a device replacement operation. Specifically, the function iommufd_hwpt_replace_device() incorrectly uses the new hwpt instead of the old one when calling iommufd_auto_response_faults(). This causes a mismatch where fault groups are not properly handled, leading to potential issues with fault handling and device domain switching.

Detection Guidance

This vulnerability is specific to the Linux kernel's iommufd subsystem and does not have a direct network detection method. Detection involves checking the kernel version and iommufd code for the described flaw. Use commands like 'uname -r' to check the kernel version and inspect iommufd source code for the incorrect parameter usage in iommufd_hwpt_replace_device().

Impact Analysis

This vulnerability could lead to incorrect fault handling in systems using the iommufd subsystem. If exploited, it might cause system instability, crashes, or unexpected behavior during device operations. Systems relying on virtualization or IOMMU (Input-Output Memory Management Unit) features could be particularly affected.

Mitigation Strategies

Apply the kernel patch that fixes the parameter mismatch in iommufd_hwpt_replace_device(). Update to a patched kernel version where the issue is resolved. Monitor vendor advisories for updates if using a distribution kernel.

Hi! I’m here to help you understand CVE-2026-80894. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70