Linux kernel (drivers/iommu/iommufd): On a partially-failed access attach, iommufd overwrites the xarray id that tracks

CVSS 7.8CVE-2024-26786Kernel, userspace & hypervisorcurated

Impact

On a partially-failed access attach, iommufd overwrites the xarray id that tracks a live access object, so a later destroy erases and frees the wrong entry. Object bookkeeping and object lifetime diverge, giving a use-after-free against the structure that owns a tenant's IOVA mappings.

Who can reach it

A holder of /dev/iommu racing an IOAS change against destroy/close on the same access object - reachable with ordinary ioctls plus close(), which is how syzkaller found it. Needs the alignment-recalculation step to fail after the id allocation succeeds, which the caller can arrange by choosing the IOAS. No host root, no hardware precondition beyond iommufd being in use.

What to do

The record lists no fixed release; boot a kernel carrying the stable fix commits below. Interim control: keep /dev/iommu out of tenant containers.

References

https://git.kernel.org/stable/c/f1fb745ee0a6fe43f1d84ec369c7e6af2310fda9 https://git.kernel.org/stable/c/9526a46cc0c378d381560279bea9aa34c84298a0 https://nvd.nist.gov/vuln/detail/CVE-2024-26786

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.