Linux kernel (drivers/iommu/iommufd): The destroy ioctl takes a temporary reference on an iommufd object without the

Impact

The destroy ioctl takes a temporary reference on an iommufd object without the lock that every other temporary reference is required to hold. Two racing destroys can therefore drop the last reference on an object still in use, breaking the lifetime rule for the fd that owns a tenant's entire IOMMU address space and page tables.

Who can reach it

A holder of /dev/iommu racing two IOMMUFD_DESTROY ioctls against each other, or a destroy against close(). syzkaller-reachable from plain userspace ioctls; no host root, no hardware precondition beyond iommufd being the passthrough path.

What to do

The record lists no fixed release; boot a kernel carrying the stable fix commits below. Interim control: keep /dev/iommu out of tenant containers.

References