CVE-2026-80894: iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace
In the Linux kernel, the following vulnerability has been resolved:
iommufd: Fix wrong hwpt passed to iommufdautoresponsefaults on replace
iommufdhwptreplacedevice() calls:
iommufdautoresponsefaults(hwpt, oldhandle);
passing the new hwpt together with the handle of the device's old domain. This should be a parameter mismatch:
1. Semantically, iommufdautoresponsefaults(x, handle) scans x->fault's deliver list and response xarray for groups matching "handle". A group is queued under the hwpt that was attached at fault-delivery time. oldhandle is fetched before the domain switch, so its group lives on old->fault, not on the new hwpt->fault.
2. Historically, the first argument was "old". The routine was introduced by commit b7d8833677ba ("iommufd: Fault-capable hwpt attach/detach/replace") as faultdomainreplacedev() in fault.c, correctly calling iommufdautoresponsefaults(old, curr). Commit fb21b1568ada ("iommufd: Make attachhandle generic than fault specific") moved this into iommufdhwptreplacedevice() in device.c and swapped it to "hwpt". This should be a refactor regression, not an intentional change.
Fix this by passing "old" instead.
Affected Software
Event History
Frequently Asked Questions
What conditions are required for this issue to occur?
The issue occurs when an iommufd hardware page-table device is replaced while fault handling is involved. The replacement path uses the device's old-domain handle but, before the fix, searched fault state on the new hardware page table instead of the old one.
What is the practical effect of the incorrect hardware page table selection?
Automatic fault responses may fail to find fault groups and response entries associated with the device's old domain. Those groups were queued on the old hardware page table at fault-delivery time, so they must be processed there.
How can I determine whether a kernel contains the fix?
Check whether the kernel includes one of the referenced stable commits: adb87155b67f9759ff010c0a99559f5bffa45dcf, 564ac339c0f8bada4e77a57a92bab9d3df635e07, or 8eb077025279304268bd58657f0af3d388822b21. The corrected code passes the old hardware page table to iommufd_auto_response_faults during device replacement.