Linux kernel (drivers/iommu/iommufd): Aborting an iommufd object allocation freed the object immediately while the

Impact

Aborting an iommufd object allocation freed the object immediately while the paired file was still sitting on the fput workqueue, so the deferred release() ran against freed memory. Confirmed slab use-after-free found by syzkaller, reachable by anything holding /dev/iommu - the same fd a passthrough tenant needs.

Who can reach it

Any process with /dev/iommu open drives an object-allocation ioctl (the fault/event queue objects are the reported path) down a failure branch so the core aborts after the file has been created. No host root, no device needed beyond the iommufd character device. Conditional on iommufd being in use and /dev/iommu being visible to the tenant - which it is on any node using the modern VFIO/iommufd passthrough stack.

What to do

No fixed release is listed in this record; apply the linked stable commits or run a current stable/LTS kernel on passthrough nodes. Interim: remove /dev/iommu from containers that do not do passthrough, and keep it restricted to the VMM process rather than the tenant workload.

References