Linux kernel (drivers/iommu/iommufd): Aborting an iommufd object allocation freed the object immediately while the

CVSS 7.8CVE-2025-39966Kernel, userspace & hypervisorcurated

Impact

Aborting an iommufd object allocation freed the object immediately while the paired file was still sitting on the fput workqueue, so the deferred release() ran against freed memory. Confirmed slab use-after-free found by syzkaller, reachable by anything holding /dev/iommu - the same fd a passthrough tenant needs.

Who can reach it

Any process with /dev/iommu open drives an object-allocation ioctl (the fault/event queue objects are the reported path) down a failure branch so the core aborts after the file has been created. No host root, no device needed beyond the iommufd character device. Conditional on iommufd being in use and /dev/iommu being visible to the tenant - which it is on any node using the modern VFIO/iommufd passthrough stack.

What to do

No fixed release is listed in this record; apply the linked stable commits or run a current stable/LTS kernel on passthrough nodes. Interim: remove /dev/iommu from containers that do not do passthrough, and keep it restricted to the VMM process rather than the tenant workload.

References

https://git.kernel.org/stable/c/17195a7d754a5c6a31888702ca93f6f08f3383ad https://git.kernel.org/stable/c/e4825368285e33d6360c6c6a6a10d2d83da06e55 https://nvd.nist.gov/vuln/detail/CVE-2025-39966

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.