Linux kernel (drivers/iommu/iommufd): An error path releases the iommufd fault object and the iommufd context twice

Impact

An error path releases the iommufd fault object and the iommufd context twice, driving their refcounts through zero. The object that owns a tenant's entire IOMMU address space gets freed while still referenced, giving a use-after-free on host kernel memory reachable from a tenant ioctl.

Who can reach it

A process holding /dev/iommu - the VMM (qemu) for a passthrough VM, or any container that was given the iommufd node. The tenant calls the fault-queue allocation ioctl and forces the tail of the handler to fail (e.g. by supplying a bad output pointer), which runs the double-release path. Conditional on iommufd being in use rather than the legacy vfio type1 container; iommufd is the default path for nested translation and I/O page-fault handling.

What to do

The record lists no fixed release; boot a kernel carrying the stable fix commits below. Interim controls: do not expose /dev/iommu to tenant containers, and keep passthrough on the legacy vfio type1 container where the workload allows it.

References