PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-23429 Linux CVE debrief

A use-after-free vulnerability was found in the Linux kernel's IOMMU subsystem. The bug occurs when the iommu_sva_unbind_device function accesses the domain->mm->iommu_mm after it has been freed by iommu_domain_free, leading to a potential crash. This vulnerability has a high CVSS score of 7.8, indicating a high severity. The issue was resolved by moving the code that accesses domain->mm->iommu_mm to before the call to iommu_domain_free. Linux kernel developers, administrators, and users of Linux-based systems should be aware of this vulnerability and take necessary actions to mitigate it.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-03
Original CVE updated
2026-07-24
Advisory published
2026-04-03
Advisory updated
2026-07-24

Who should care

Linux kernel developers, administrators, and users of Linux-based systems, especially those using kernel versions 6.18.7 to 6.18.20, 6.19.1 to 6.19.10, and 7.0 rc1 to rc7, should be aware of this vulnerability and take necessary actions to mitigate it. They should review the official advisory and apply the patches provided by the Linux kernel maintainers.

Technical summary

The vulnerability exists in the iommu_sva_unbind_device function, where it accesses domain->mm->iommu_mm after it has been freed. This can cause a crash due to accessing memory that has already been released. The issue was resolved by moving the code that accesses domain->mm->iommu_mm to before the call to iommu_domain_free. The fix involves updating the Linux kernel to a version that includes the patch, such as 6.18.21 or later, 6.19.11 or later.

Defensive priority

High priority due to the high CVSS score of 7.8 and the potential for system crashes.

Recommended defensive actions

  • Apply the official patches provided by the Linux kernel maintainers.
  • Update to a kernel version that includes the fix, such as 6.18.21 or later, 6.19.11 or later.
  • Monitor system logs for potential crashes or errors related to the IOMMU subsystem.
  • Consider implementing additional security measures, such as memory protection keys or control flow integrity.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record was published on 2026-04-03T16:16:24.210Z and last modified on 2026-07-24T21:10:00.143Z. The NVD entry is currently Modified. This vulnerability affects Linux kernel versions 6.18.7 to 6.18.20, 6.19.1 to 6.19.10, and 7.0 rc1 to rc7. Defenders should verify the presence of affected systems in their environment and review the official advisory for specific guidance.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-04-03T16:16:24.210Z and has not been modified since then. The NVD entry is currently Modified.