CVE-2026-89451: iommu/sva: Set handle->dev before the SVA handle is visible
In the Linux kernel, the following vulnerability has been resolved:
iommu/sva: Set handle->dev before the SVA handle is visible
iommuattachdevicepasid() installs the new SVA attach handle in the group PASID lookup before iommusvabinddevice() returns. A concurrent bind can therefore find and reuse the same handle after iommusvalock is dropped.
handle->dev was initialized after dropping iommusvalock. This leaves a window where a racing bind can return a handle whose dev pointer is still NULL. A subsequent iommusvaunbinddevice() can then dereference it via handle->dev->iommugroup.
Initialize handle->dev before releasing iommusvalock so any visible SVA handle is fully initialized.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
What conditions are required to trigger the issue?
The issue requires concurrent SVA device-bind activity: one bind makes an SVA handle visible while another racing bind finds and reuses it before its dev pointer has been initialized. A later unbind of that handle can dereference the NULL dev pointer.
What is the practical impact of a successful race?
A subsequent iommu_sva_unbind_device() can dereference handle->dev through handle->dev->iommu_group while handle->dev is NULL. The provided data identifies this as a kernel vulnerability but does not specify further impact such as privilege escalation or information disclosure.
What change mitigates the race when applying the fix?
Initialize handle->dev before releasing iommu_sva_lock, ensuring that every SVA handle visible through the group PASID lookup is fully initialized. The listed stable kernel references contain the corresponding fixes.