CVE-2026-89447: iommufd: Avoid locking internal accesses during unmap

Published Sep 11, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

iommufd: Avoid locking internal accesses during unmap

iommufdaccessnotifyunmap() skips internal accesses because they do not have an external unmap callback to invoke.

However, the current test calls iommufdlockobj() before checking whether the access is internal. If iommufdlockobj() succeeds, the loop then sees the internal access and continues, bypassing the matching iommufdputobject() used by the normal unmap path. This leaks the object reference taken by iommufdlockobj().

Check for internal accesses first so skipped entries are never locked.

Affected Software

1 affected component
Linux Linux kernel

Event History

Sep 11, 2026
CVE Published
via MITRE·07:43 PM
Data Sourced
via MITRE·07:43 PM
Description

Frequently Asked Questions

1

What systems are exposed to this issue?

Linux kernel systems using iommufd are exposed when an unmap operation encounters an internal iommufd access. The issue is in the iommufd unmap notification path rather than a general memory-unmap path.

2

Can this be exploited without access to iommufd operations?

The described reference leak requires triggering iommufd unmap handling involving internal accesses. The provided information does not establish an attack path for users or workloads that cannot perform or influence those operations.

3

What happens if the issue is triggered?

An object reference acquired by iommufd_lock_obj() is not released for an internal access, because the loop continues before reaching the normal iommufd_put_object() path. Repeated triggering can therefore leak object references.

4

What can be done before applying a fixed kernel?

Limit or avoid iommufd use and unmap activity involving internal accesses where operationally feasible. The supplied data does not provide a separate configuration workaround.

5

How can administrators determine whether they are affected?

Confirm whether the running kernel contains one of the referenced stable fixes, and whether the environment uses iommufd. The provided information does not include affected version ranges or a runtime detection indicator.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203