CVE-2026-89453: iommu/amd: Put PCI device after handling PPR faults
In the Linux kernel, the following vulnerability has been resolved:
iommu/amd: Put PCI device after handling PPR faults
iommucalliopfnotifier() looks up the requester with pcigetdomainbusandslot(), which returns a PCI device with its reference count incremented.
Neither the successful iommureportdevicefault() path nor the abort path drops that reference, so every handled PPR request leaks a PCI device reference.
This is the same ownership rule that was fixed for the old iommuv2 pprnotifier() path by commit 6cf0981c2233 ("iommu/amd: Fix pci device refcount leak in pprnotifier()"), but iommucalliopfnotifier() was added later as a separate PPR/IOPF notifier path.
Drop the PCI device reference after handling the PPR entry.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Drop the PCI device reference after handling the PPR entry in iommu_call_iopf_notifier(), including both the successful iommu_report_device_fault() path and the abort path.
Event History
Frequently Asked Questions
What systems are exposed to this reference leak?
Systems that handle AMD IOMMU PPR faults through the iommu_call_iopf_notifier() path are exposed. Each handled PPR request on that path can retain an additional reference to the associated PCI device.
Does an attacker need to trigger a specific condition?
The leak occurs when a PPR request is handled through the affected notifier path. The provided information does not specify a remote attack vector, required privileges, or a method for an attacker to generate those requests.
What can be done if the fix cannot be deployed immediately?
The provided information identifies the affected condition as handled PPR requests in the AMD IOMMU IOPF notifier path, but does not provide a documented mitigation or configuration workaround. Reducing or avoiding workloads that generate such requests may limit additional leaked references, but this is not stated as a verified mitigation.