CVE-2026-89445

Received Received - Intake

Use-After-Free in Linux Kernel iommufd selftest

Publication date: 2026-09-11

Last updated on: 2026-09-13

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix UAF in selftest IOPF reporting IOMMUFD selftest TRIGGER_IOPF borrows an attach handle from group->pasid_array without synchronizing against PASID detach, then a concurrent iommu_report_device_fault() can dereference that borrowed handle's domain pointer after the detach erases the handle and frees the backing struct iommufd_attach_handle. TRIGGER_IOPF then dereferences the freed handle, causing a UAF. Fix by adding a iopf_rwsem in mock_dev to follow the expected design of a real driver. Hold its read side across the whole iommu_report_device_fault() call, and its write side around every path that attaches, detaches, or replaces a device domain. This can block new reports and drains in-flight reports before an old attach handle or the IOPF fault parameter can be removed. Also take the write side while registering a mock device, since it can invoke the mock driver's default-domain attach callback.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-13

Generated

2026-10-02

AI Q&A

2026-09-12

EPSS Evaluated

2026-09-29

NVD

CVE-2026-89445

EUVD

EUVD-2026-76351

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Use-After-Free (UAF) vulnerability in the Linux kernel's IOMMUFD selftest module. It occurs when the TRIGGER_IOPF test borrows an attach handle without proper synchronization during PASID detach operations. A concurrent fault report can then dereference a freed handle, leading to memory corruption.

Detection Guidance

This vulnerability is specific to the Linux kernel's iommufd subsystem and requires kernel-level detection. Check if your system uses iommufd with commands like 'lsmod | grep iommufd' or 'dmesg | grep iommufd'. Monitor kernel logs for UAF-related errors or crashes in iommufd components.

Impact Analysis

This vulnerability could allow an attacker with local access to cause a kernel crash or execute arbitrary code with elevated privileges. It primarily affects systems using IOMMUFD features, particularly those with virtualization or device passthrough capabilities.

Compliance Impact

This vulnerability is specific to the Linux kernel's IOMMUFD subsystem and involves a use-after-free (UAF) issue in selftest IOPF reporting. It does not directly relate to data protection standards like GDPR or HIPAA, as those focus on data privacy and security controls rather than kernel memory management flaws.

Mitigation Strategies

Apply the latest Linux kernel patches to address the UAF issue in iommufd. Avoid using iommufd selftests (TRIGGER_IOPF) until patched. Monitor vendor advisories for updates to distributions using affected kernels.

Hi! I’m here to help you understand CVE-2026-89445. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70