UBUNTU-CVE-2026-90242: Medium severity ubuntu/linux-hwe-edge vulnerability

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix iopfrefcount leak on RID domain replacement inteliommuattachdevice() enables IOPF for the new domain but never disables it for the old one. deviceblocktranslation(), called at the start of the function, tears down translation but does not touch any IOPF state; blockingdomainattachdev() has to call iopffordomainremove() explicitly before invoking it for exactly this reason. identitydomainattachdev() has the same problem. Its comment claims that no PRI handling is needed because the device has been put in the blocking state, but the blocking state and the IOPF reference count are independent of each other. As a result, replacing a domain that has an iopfhandler with another domain at RID level leaks a reference in info->iopfrefcount. The count never drops back to zero, so iopfqueueremovedevice() is never called and iommudisablepcipri() triggers its WARNON(info->iopfrefcount) when the device is released. The PASID paths already handle this correctly by way of iopffordomainreplace(); convert the two RID paths to do the same. Using the replace helper rather than a bare remove keeps the enable before the disable, so the reference count does not transiently reach zero and evict the device from the IOPF queue.