CVE-2026-89447: iommufd: Avoid locking internal accesses during unmap
In the Linux kernel, the following vulnerability has been resolved:
iommufd: Avoid locking internal accesses during unmap
iommufdaccessnotifyunmap() skips internal accesses because they do not have an external unmap callback to invoke.
However, the current test calls iommufdlockobj() before checking whether the access is internal. If iommufdlockobj() succeeds, the loop then sees the internal access and continues, bypassing the matching iommufdputobject() used by the normal unmap path. This leaks the object reference taken by iommufdlockobj().
Check for internal accesses first so skipped entries are never locked.
Affected Software
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Linux kernel systems using iommufd are exposed when an unmap operation encounters an internal iommufd access. The issue is in the iommufd unmap notification path rather than a general memory-unmap path.
Can this be exploited without access to iommufd operations?
The described reference leak requires triggering iommufd unmap handling involving internal accesses. The provided information does not establish an attack path for users or workloads that cannot perform or influence those operations.
What happens if the issue is triggered?
An object reference acquired by iommufd_lock_obj() is not released for an internal access, because the loop continues before reaching the normal iommufd_put_object() path. Repeated triggering can therefore leak object references.
What can be done before applying a fixed kernel?
Limit or avoid iommufd use and unmap activity involving internal accesses where operationally feasible. The supplied data does not provide a separate configuration workaround.
How can administrators determine whether they are affected?
Confirm whether the running kernel contains one of the referenced stable fixes, and whether the environment uses iommufd. The provided information does not include affected version ranges or a runtime detection indicator.