CVE-2026-89449: iommu: Fix dev_iommu memory leak when device_add fails in iommu_mock_device_add
In the Linux kernel, the following vulnerability has been resolved:
iommu: Fix deviommu memory leak when deviceadd fails in iommumockdeviceadd
iommumockdeviceadd() first calls iommufwspecinit(), which on success allocates both dev->iommu (via deviommuget()) and dev->iommu->fwspec. If the subsequent deviceadd(dev) call fails, the error path only calls iommufwspecfree(dev), which frees fwspec but leaves dev->iommu still allocated.
This triggers the following kmemleak report when fuzzing with Syzkaller:
BUG: memory leak unreferenced object 0xffff888011e0a200 (size 192): comm "syz.1.1695", pid 24885, jiffies 4295222527 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 ad 4e ad de .............N.. ff ff ff ff 00 00 00 00 ff ff ff ff ff ff ff ff ................ backtrace (crc 25df5bb3): kmemleakallocrecursive include/linux/kmemleak.h:44 [inline] slabpostallochook mm/slub.c:4575 [inline] slaballocnode mm/slub.c:4899 [inline] kmalloccachenoprof+0x47a/0x710 mm/slub.c:5415 kmallocnoprof include/linux/slab.h:950 [inline] kzallocnoprof include/linux/slab.h:1188 [inline] deviommuget+0x10c/0x1a0 drivers/iommu/iommu.c:408 iommufwspecinit+0x288/0x4d0 drivers/iommu/iommu.c:3087 iommumockdeviceadd+0x46/0xb0 drivers/iommu/iommu.c:385 mockdevcreate drivers/iommu/iommufd/selftest.c:1025 [inline] iommufdtestmockdomain drivers/iommu/iommufd/selftest.c:1066 [inline] iommufdtest+0x2f8a/0x6190 drivers/iommu/iommufd/selftest.c:2072 iommufdfopsioctl+0x367/0x540 drivers/iommu/iommufd/main.c:533 vfsioctl fs/ioctl.c:51 [inline] dosysioctl fs/ioctl.c:597 [inline] sesysioctl fs/ioctl.c:583 [inline] x64sysioctl+0x18e/0x210 fs/ioctl.c:583 dosyscallx64 arch/x86/entry/syscall64.c:63 [inline] dosyscall64+0x116/0x800 arch/x86/entry/syscall64.c:94 entrySYSCALL64afterhwframe+0x77/0x7f
Fix this by calling deviommufree(dev) instead of iommufwspecfree(dev) in the deviceadd() failure path. deviommufree() frees both fwspec and the outer deviommu struct and clears dev->iommu.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch iommu: Fix dev_iommu memory leak when device_add fails in iommu_mock_device_add - Configuration
In the iommu_mock_device_add() failure path after a failed device_add(dev), free the allocated dev->iommu using dev_iommu_free(dev) (which frees both dev->iommu->fwspec and clears dev->iommu) instead of only calling iommu_fwspec_free(dev), to prevent the dev->iommu memory leak.
Linux kernel iommu_mock_device_add / iommufd device_add failure path cleanup = call dev_iommu_free(dev) instead of iommu_fwspec_free(dev)
Event History
Frequently Asked Questions
What condition triggers the leak?
The leak occurs when iommu_mock_device_add() successfully initializes the IOMMU firmware specification and then device_add(dev) fails. The failure path frees the firmware specification but leaves the dev->iommu allocation behind.
How can administrators or developers detect that this has occurred?
The issue was observed as an unreferenced 192-byte allocation reported by kmemleak, with the allocation originating in dev_iommu_get() during iommu_fwspec_init(). The report was triggered while fuzzing with Syzkaller.