CVE-2026-89445 Linux CVE debrief

Who should care

Linux kernel developers, administrators, and users of systems that utilize the IOMMUFD selftest TRIGGER_IOPF should assess exposure and prioritize verification of affected systems.

Why it matters

A use-after-free vulnerability in the Linux kernel's IOMMUFD selftest TRIGGER_IOPF requires verification of affected systems and application of the provided fix to prevent potential use-after-free conditions.

• Verification of affected Linux kernel versions and IOMMUFD selftest TRIGGER_IOPF usage is required.
• Potential use-after-free condition when a concurrent iommu_report_device_fault() is called.
• Applying the provided fix is necessary to prevent the vulnerability.

Technical summary

The Linux kernel's IOMMUFD selftest TRIGGER_IOPF has a use-after-free vulnerability. The issue arises from borrowing an attach handle from group->pasid_array without proper synchronization against PASID detach. This can lead to a use-after-free condition when a concurrent iommu_report_device_fault() is called. The vulnerability was resolved by adding a iopf_rwsem in mock_dev to follow the expected design of a real driver, holding its read side across the whole iommu_report_device_fault() call, and its write side around every path that attaches, detaches, or replaces a device domain.

Defensive priority

Linux kernel developers and administrators should assess exposure and prioritize verification of affected systems.

Recommended defensive actions

• Review Linux kernel patch notes and related documentation to understand the vulnerability and potential impact.
• Verify if the system uses the affected IOMMUFD selftest TRIGGER_IOPF and assess exposure.
• Apply the provided fix by adding a iopf_rwsem in mock_dev to synchronize against PASID detach.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability was resolved by adding a iopf_rwsem in mock_dev to follow the expected design of a real driver. Limited information is available about potential exploitation or impact. The fix involves holding a read side across the whole iommu_report_device_fault() call and a write side around every path that attaches, detaches, or replaces a device domain. This change can block new reports and drain in-flight reports before an old attach handle or the IOPF fault parameter can be removed. The selftest TRIGGER_IOPF borrows an attach

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.