CVE-2026-89449: iommu: Fix dev_iommu memory leak when device_add fails in iommu_mock_device_add

Published Sep 11, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

iommu: Fix deviommu memory leak when deviceadd fails in iommumockdeviceadd

iommumockdeviceadd() first calls iommufwspecinit(), which on success allocates both dev->iommu (via deviommuget()) and dev->iommu->fwspec. If the subsequent deviceadd(dev) call fails, the error path only calls iommufwspecfree(dev), which frees fwspec but leaves dev->iommu still allocated.

This triggers the following kmemleak report when fuzzing with Syzkaller:

BUG: memory leak unreferenced object 0xffff888011e0a200 (size 192): comm "syz.1.1695", pid 24885, jiffies 4295222527 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 ad 4e ad de .............N.. ff ff ff ff 00 00 00 00 ff ff ff ff ff ff ff ff ................ backtrace (crc 25df5bb3): kmemleakallocrecursive include/linux/kmemleak.h:44 [inline] slabpostallochook mm/slub.c:4575 [inline] slaballocnode mm/slub.c:4899 [inline] kmalloccachenoprof+0x47a/0x710 mm/slub.c:5415 kmallocnoprof include/linux/slab.h:950 [inline] kzallocnoprof include/linux/slab.h:1188 [inline] deviommuget+0x10c/0x1a0 drivers/iommu/iommu.c:408 iommufwspecinit+0x288/0x4d0 drivers/iommu/iommu.c:3087 iommumockdeviceadd+0x46/0xb0 drivers/iommu/iommu.c:385 mockdevcreate drivers/iommu/iommufd/selftest.c:1025 [inline] iommufdtestmockdomain drivers/iommu/iommufd/selftest.c:1066 [inline] iommufdtest+0x2f8a/0x6190 drivers/iommu/iommufd/selftest.c:2072 iommufdfopsioctl+0x367/0x540 drivers/iommu/iommufd/main.c:533 vfsioctl fs/ioctl.c:51 [inline] dosysioctl fs/ioctl.c:597 [inline] sesysioctl fs/ioctl.c:583 [inline] x64sysioctl+0x18e/0x210 fs/ioctl.c:583 dosyscallx64 arch/x86/entry/syscall64.c:63 [inline] dosyscall64+0x116/0x800 arch/x86/entry/syscall64.c:94 entrySYSCALL64afterhwframe+0x77/0x7f

Fix this by calling deviommufree(dev) instead of iommufwspecfree(dev) in the deviceadd() failure path. deviommufree() frees both fwspec and the outer deviommu struct and clears dev->iommu.

Affected Software

1 affected component
Linux Linux kernel

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Patch iommu: Fix dev_iommu memory leak when device_add fails in iommu_mock_device_add
  2. Configuration

    In the iommu_mock_device_add() failure path after a failed device_add(dev), free the allocated dev->iommu using dev_iommu_free(dev) (which frees both dev->iommu->fwspec and clears dev->iommu) instead of only calling iommu_fwspec_free(dev), to prevent the dev->iommu memory leak.

    Linux kernel iommu_mock_device_add / iommufd device_add failure path cleanup = call dev_iommu_free(dev) instead of iommu_fwspec_free(dev)

Event History

Sep 11, 2026
CVE Published
via MITRE·07:43 PM
Data Sourced
via MITRE·07:43 PM
Description

Frequently Asked Questions

1

What condition triggers the leak?

The leak occurs when iommu_mock_device_add() successfully initializes the IOMMU firmware specification and then device_add(dev) fails. The failure path frees the firmware specification but leaves the dev->iommu allocation behind.

2

How can administrators or developers detect that this has occurred?

The issue was observed as an unreferenced 192-byte allocation reported by kmemleak, with the allocation originating in dev_iommu_get() during iommu_fwspec_init(). The report was triggered while fuzzing with Syzkaller.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203