UBUNTU-CVE-2026-89449: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: iommu: Fix deviommu memory leak when deviceadd fails in iommumockdeviceadd iommumockdeviceadd() first calls iommufwspecinit(), which on success allocates both dev->iommu (via deviommuget()) and dev->iommu->fwspec. If the subsequent deviceadd(dev) call fails, the error path only calls iommufwspecfree(dev), which frees fwspec but leaves dev->iommu still allocated. This triggers the following kmemleak report when fuzzing with Syzkaller: BUG: memory leak unreferenced object 0xffff888011e0a200 (size 192): comm "syz.1.1695", pid 24885, jiffies 4295222527 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 ad 4e ad de .............N.. ff ff ff ff 00 00 00 00 ff ff ff ff ff ff ff ff ................ backtrace (crc 25df5bb3): kmemleakallocrecursive include/linux/kmemleak.h:44 [inline] slabpostallochook mm/slub.c:4575 [inline] slaballocnode mm/slub.c:4899 [inline] kmalloccachenoprof+0x47a/0x710 mm/slub.c:5415 kmallocnoprof include/linux/slab.h:950 [inline] kzallocnoprof include/linux/slab.h:1188 [inline] deviommuget+0x10c/0x1a0 drivers/iommu/iommu.c:408 iommufwspecinit+0x288/0x4d0 drivers/iommu/iommu.c:3087 iommumockdeviceadd+0x46/0xb0 drivers/iommu/iommu.c:385 mockdevcreate drivers/iommu/iommufd/selftest.c:1025 [inline] iommufdtestmockdomain drivers/iommu/iommufd/selftest.c:1066 [inline] iommufdtest+0x2f8a/0x6190 drivers/iommu/iommufd/selftest.c:2072 iommufdfopsioctl+0x367/0x540 drivers/iommu/iommufd/main.c:533 vfsioctl fs/ioctl.c:51 [inline] dosysioctl fs/ioctl.c:597 [inline] sesysioctl fs/ioctl.c:583 [inline] x64sysioctl+0x18e/0x210 fs/ioctl.c:583 dosyscallx64 arch/x86/entry/syscall64.c:63 [inline] dosyscall64+0x116/0x800 arch/x86/entry/syscall64.c:94 entrySYSCALL64afterhwframe+0x77/0x7f Fix this by calling deviommufree(dev) instead of iommufwspecfree(dev) in the deviceadd() failure path. deviommufree() frees both fwspec and the outer deviommu struct and clears dev->iommu.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In the device_add() failure path of iommu_mock_device_add(), call dev_iommu_free(dev) instead of iommu_fwspec_free(dev) so both fwspec and the outer dev_iommu structure are freed and dev->iommu is cleared.
Event History
Frequently Asked Questions
What condition triggers the leak?
The leak occurs when iommu_mock_device_add() successfully initializes the IOMMU firmware specification and then device_add(dev) fails. The failure path frees the fwspec but does not free the associated dev->iommu allocation.
Which Ubuntu kernel packages are listed as affected?
The listed packages are ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-hwe-edge, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, and ubuntu/linux-aws-5.0.
How was the issue observed?
It was observed through a kmemleak report while fuzzing with Syzkaller. The report identifies an unreferenced 192-byte allocation originating from dev_iommu_get().