CVE-2026-89449: iommu: Fix dev_iommu memory leak when device_add fails in iommu_mock_device_add
In the Linux kernel, the following vulnerability has been resolved:
iommu: Fix deviommu memory leak when deviceadd fails in iommumockdeviceadd
iommumockdeviceadd() first calls iommufwspecinit(), which on success allocates both dev->iommu (via deviommuget()) and dev->iommu->fwspec. If the subsequent deviceadd(dev) call fails, the error path only calls iommufwspecfree(dev), which frees fwspec but leaves dev->iommu still allocated.
This triggers the following kmemleak report when fuzzing with Syzkaller:
BUG: memory leak unreferenced object 0xffff888011e0a200 (size 192): comm "syz.1.1695", pid 24885, jiffies 4295222527 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 ad 4e ad de .............N.. ff ff ff ff 00 00 00 00 ff ff ff ff ff ff ff ff ................ backtrace (crc 25df5bb3): kmemleakallocrecursive include/linux/kmemleak.h:44 [inline] slabpostallochook mm/slub.c:4575 [inline] slaballocnode mm/slub.c:4899 [inline] kmalloccachenoprof+0x47a/0x710 mm/slub.c:5415 kmallocnoprof include/linux/slab.h:950 [inline] kzallocnoprof include/linux/slab.h:1188 [inline] deviommuget+0x10c/0x1a0 drivers/iommu/iommu.c:408 iommufwspecinit+0x288/0x4d0 drivers/iommu/iommu.c:3087 iommumockdeviceadd+0x46/0xb0 drivers/iommu/iommu.c:385 mockdevcreate drivers/iommu/iommufd/selftest.c:1025 [inline] iommufdtestmockdomain drivers/iommu/iommufd/selftest.c:1066 [inline] iommufdtest+0x2f8a/0x6190 drivers/iommu/iommufd/selftest.c:2072 iommufdfopsioctl+0x367/0x540 drivers/iommu/iommufd/main.c:533 vfsioctl fs/ioctl.c:51 [inline] dosysioctl fs/ioctl.c:597 [inline] sesysioctl fs/ioctl.c:583 [inline] x64sysioctl+0x18e/0x210 fs/ioctl.c:583 dosyscallx64 arch/x86/entry/syscall64.c:63 [inline] dosyscall64+0x116/0x800 arch/x86/entry/syscall64.c:94 entrySYSCALL64afterhwframe+0x77/0x7f
Fix this by calling deviommufree(dev) instead of iommufwspecfree(dev) in the deviceadd() failure path. deviommufree() frees both fwspec and the outer deviommu struct and clears dev->iommu.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In iommu_mock_device_add(), change the device_add() failure path to call dev_iommu_free(dev) instead of iommu_fwspec_free(dev), so both dev->iommu->fwspec and the outer dev_iommu structure are freed and dev->iommu is cleared.
Event History
Frequently Asked Questions
What condition triggers the leak?
The leak occurs when iommu_mock_device_add() successfully initializes the IOMMU firmware specification and then device_add(dev) fails. The failure path frees the firmware specification but leaves the dev->iommu allocation behind.
How can administrators or developers detect that this has occurred?
The issue was observed as an unreferenced 192-byte allocation reported by kmemleak, with the allocation originating in dev_iommu_get() during iommu_fwspec_init(). The report was triggered while fuzzing with Syzkaller.