CVE-2026-89453: iommu/amd: Put PCI device after handling PPR faults

Published Sep 11, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

iommu/amd: Put PCI device after handling PPR faults

iommucalliopfnotifier() looks up the requester with pcigetdomainbusandslot(), which returns a PCI device with its reference count incremented.

Neither the successful iommureportdevicefault() path nor the abort path drops that reference, so every handled PPR request leaks a PCI device reference.

This is the same ownership rule that was fixed for the old iommuv2 pprnotifier() path by commit 6cf0981c2233 ("iommu/amd: Fix pci device refcount leak in pprnotifier()"), but iommucalliopfnotifier() was added later as a separate PPR/IOPF notifier path.

Drop the PCI device reference after handling the PPR entry.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade Linux kernel (iommu/amd) to a version that resolves this vulnerability.

    Patch 6cf0981c2233

Event History

Sep 11, 2026
CVE Published
via MITRE·07:43 PM
Data Sourced
via MITRE·07:43 PM
Description

Frequently Asked Questions

1

What systems are exposed to this reference leak?

Systems that handle AMD IOMMU PPR faults through the iommu_call_iopf_notifier() path are exposed. Each handled PPR request on that path can retain an additional reference to the associated PCI device.

2

Does an attacker need to trigger a specific condition?

The leak occurs when a PPR request is handled through the affected notifier path. The provided information does not specify a remote attack vector, required privileges, or a method for an attacker to generate those requests.

3

What can be done if the fix cannot be deployed immediately?

The provided information identifies the affected condition as handled PPR requests in the AMD IOMMU IOPF notifier path, but does not provide a documented mitigation or configuration workaround. Reducing or avoiding workloads that generate such requests may limit additional leaked references, but this is not stated as a verified mitigation.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203