CVE-2026-93205: iommu/arm-smmu-v3: Manage teardown with devm
In the Linux kernel, the following vulnerability has been resolved:
iommu/arm-smmu-v3: Manage teardown with devm
armsmmudeviceremove() manually frees the IOPF queue, destroys the vmidmap and disables the device, while the IRQs and queues are devm managed. devm unwinds only after remove() returns, so the cleanup runs in the wrong order. The IOPF queue is freed before the event-queue IRQ whose handler uses it.
Manage all of it with devm so the unwind order is correct. Free the IOPF queue and vmidmap via devm actions, and disable the device from one registered after armsmmudevicereset().
This is also a prerequisite for fixing a Tegra241 CMDQV CMDSYNC use-after-free in the subsequent patch.
Affected Software
Event History
Frequently Asked Questions
When is the vulnerable cleanup path reached?
The incorrect cleanup ordering occurs during arm_smmu_device_remove(), so it is associated with ARM SMMU v3 device teardown or removal. No other trigger conditions are specified.
What makes the teardown sequence unsafe?
The IOPF queue can be freed before the event-queue IRQ is unwound, even though that IRQ handler uses the queue. This creates a use-after-free condition during cleanup.