UBUNTU-CVE-2026-89445: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix UAF in selftest IOPF reporting IOMMUFD selftest TRIGGERIOPF borrows an attach handle from group->pasidarray without synchronizing against PASID detach, then a concurrent iommureportdevicefault() can dereference that borrowed handle's domain pointer after the detach erases the handle and frees the backing struct iommufdattachhandle. TRIGGERIOPF then dereferences the freed handle, causing a UAF. Fix by adding a iopfrwsem in mockdev to follow the expected design of a real driver. Hold its read side across the whole iommureportdevicefault() call, and its write side around every path that attaches, detaches, or replaces a device domain. This can block new reports and drains in-flight reports before an old attach handle or the IOPF fault parameter can be removed. Also take the write side while registering a mock device, since it can invoke the mock driver's default-domain attach callback.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Add an iopf_rwsem to mock_dev. Hold its read side across the entire iommu_report_device_fault() call, and hold its write side around every path that attaches, detaches, or replaces a device domain, including while registering a mock device.