CVE-2026-89446: iommufd: Release current IOAS on xa_store() failure
In the Linux kernel, the following vulnerability has been resolved:
iommufd: Release current IOAS on xastore() failure
iommufdtakealliovarwsem() takes an object reference and the iovarwsem write lock before storing the IOAS in the temporary ioaslist xarray.
If xastore() fails, the current IOAS has not been inserted into ioaslist yet. iommufdreleasealliovarwsem() only unwinds IOAS objects already present in that xarray, so it cannot release the current IOAS.
Release the current IOAS rwsem and object reference before unwinding the previously stored entries.
Affected Software
Event History
Frequently Asked Questions
What condition is required to trigger the resource leak?
The failure path is triggered when xa_store() fails while iommufd_take_all_iova_rwsem() is adding the current IOAS to its temporary ioas_list xarray. The affected IOAS has already had its iova_rwsem write lock acquired and its object reference taken at that point.
What is the impact of the failed xa_store() path?
The current IOAS is not present in the temporary xarray, so the normal unwind routine does not release its write lock or object reference. Previously stored IOAS entries are still unwound, but the current entry remains locked and referenced.
How can this be remediated?
Apply a kernel update containing the fix referenced by the listed stable commits. The corrected failure path releases the current IOAS rwsem and object reference before unwinding entries already stored in the xarray.