CVE-2026-89451

Received Received - Intake

Race Condition in Linux Kernel IOMMU SVA Handle

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: iommu/sva: Set handle->dev before the SVA handle is visible iommu_attach_device_pasid() installs the new SVA attach handle in the group PASID lookup before iommu_sva_bind_device() returns. A concurrent bind can therefore find and reuse the same handle after iommu_sva_lock is dropped. handle->dev was initialized after dropping iommu_sva_lock. This leaves a window where a racing bind can return a handle whose dev pointer is still NULL. A subsequent iommu_sva_unbind_device() can then dereference it via handle->dev->iommu_group. Initialize handle->dev before releasing iommu_sva_lock so any visible SVA handle is fully initialized.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-89451

EUVD

EUVD-2026-76357

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a race condition in the IOMMU SVA (Shared Virtual Addressing) subsystem. The issue occurs when a new SVA handle is installed before it is fully initialized. Specifically, the handle's device pointer is set after releasing a lock, creating a window where a concurrent operation could access an uninitialized pointer, potentially leading to a null pointer dereference.

Detection Guidance

This vulnerability is specific to the Linux kernel's IOMMU subsystem and requires kernel-level inspection. Detection involves checking kernel logs for IOMMU-related errors or verifying if your kernel version includes the fix. Commands like 'dmesg | grep iommu' or 'uname -r' may help identify affected systems.

Impact Analysis

This vulnerability could cause system instability or crashes if exploited. A malicious actor might trigger a race condition to corrupt kernel memory, leading to denial-of-service or privilege escalation. Systems using IOMMU with SVA features are primarily affected.

Mitigation Strategies

Apply the latest kernel update from your Linux distribution to ensure the fix is included. If immediate patching is not possible, consider disabling IOMMU SVA features if not required, but this may impact functionality.

Hi! I’m here to help you understand CVE-2026-89451. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70