UBUNTU-CVE-2026-89453: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Put PCI device after handling PPR faults iommucalliopfnotifier() looks up the requester with pcigetdomainbusandslot(), which returns a PCI device with its reference count incremented. Neither the successful iommureportdevicefault() path nor the abort path drops that reference, so every handled PPR request leaks a PCI device reference. This is the same ownership rule that was fixed for the old iommuv2 pprnotifier() path by commit 6cf0981c2233 ("iommu/amd: Fix pci device refcount leak in pprnotifier()"), but iommucalliopfnotifier() was added later as a separate PPR/IOPF notifier path. Drop the PCI device reference after handling the PPR entry.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Drop the PCI device reference returned by pci_get_domain_bus_and_slot() after handling each PPR fault in iommu_call_iopf_notifier(), on both the successful iommu_report_device_fault() path and the abort path.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The affected software listed is Ubuntu kernel packages: linux-riscv, linux-realtime, linux-hwe-edge, linux-azure, linux-gcp, linux-azure-fde, linux-gke, and linux-aws-5.0. The leak occurs on the AMD IOMMU PPR/IOPF notifier path when PPR faults are handled.
What triggers the resource leak?
Each handled PPR request that passes through iommu_call_iopf_notifier() obtains a PCI device reference using pci_get_domain_bus_and_slot() without releasing it afterward. Both the successful fault-reporting path and the abort path previously retained that reference.
How can an administrator determine whether the issue is addressed?
Verify that the installed Ubuntu kernel includes the fix that drops the PCI device reference after handling the PPR entry. The upstream fix is identified by commit af3b69b16383fbc8fe5f61b5b0150d2e41ede71f.