CVE-2026-80687: iommufd/viommu: Release the igroup lock on the vdevice_size error path
In the Linux kernel, the following vulnerability has been resolved:
iommufd/viommu: Release the igroup lock on the vdevicesize error path
iommufdvdeviceallocioctl() takes idev->igroup->lock, then validates the driver's vdevicesize against the core structure size with a WARNONONCE. On failure that guard jumps to outputidev, below outunlockigroup, so it skips the mutexunlock(), leaving the igroup lock held and deadlocking the next vDEVICE operation on that group.
Jump to outunlockigroup instead.
Affected Software
Event History
Frequently Asked Questions
What condition triggers the deadlock?
It is triggered when iommufd_vdevice_alloc_ioctl() finds that the driver's vdevice_size is invalid relative to the core structure size. The validation uses WARN_ON_ONCE, and the failing error path previously skipped releasing the igroup mutex.
What is the operational impact after the error occurs?
The igroup lock remains held. A subsequent vDEVICE operation on the same group can deadlock.
How can this be recognized during investigation?
Look for a WARN_ON_ONCE associated with vdevice_size validation followed by vDEVICE operations on the affected igroup no longer making progress. The corrected behavior routes the failure path through igroup lock release.