Linux kernel (drivers/iommu/iommufd): On a partially-failed access attach, iommufd overwrites the xarray id that tracks

Impact

On a partially-failed access attach, iommufd overwrites the xarray id that tracks a live access object, so a later destroy erases and frees the wrong entry. Object bookkeeping and object lifetime diverge, giving a use-after-free against the structure that owns a tenant's IOVA mappings.

Who can reach it

A holder of /dev/iommu racing an IOAS change against destroy/close on the same access object - reachable with ordinary ioctls plus close(), which is how syzkaller found it. Needs the alignment-recalculation step to fail after the id allocation succeeds, which the caller can arrange by choosing the IOAS. No host root, no hardware precondition beyond iommufd being in use.

What to do

The record lists no fixed release; boot a kernel carrying the stable fix commits below. Interim control: keep /dev/iommu out of tenant containers.

References