Linux kernel (drivers/iommu): The IOMMU group's domain pointer is left stale when a device reset races a detach, and

CVSS 8.8CVE-2026-52952Kernel, userspace & hypervisorcurated

Impact

The IOMMU group's domain pointer is left stale when a device reset races a detach, and the reset-completion path then re-attaches a domain that has already been freed. That is a use-after-free on the object that defines which host memory a passed-through device may DMA to - the strongest primitive a tenant device can get for reaching outside its own address space.

Who can reach it

A tenant holding /dev/vfio/* triggers a device reset - VFIO_DEVICE_RESET, or simply closing the device fd, which resets on release - while another thread detaches or replaces the domain. Multi-device IOMMU groups and PCI DMA-alias quirks widen the window, and those are common in GPU topologies behind PCIe switches. No host root required.

What to do

Update to a stable kernel carrying commits 8fc289e8 / 5474e6e1. Interim: put each tenant's passthrough devices in a single-device IOMMU group where the topology allows it (ACS on the upstream switch ports), and avoid handing tenants devices whose group contains functions belonging to other workloads.

References

https://git.kernel.org/stable/c/8fc289e809f3eb7e36cadc4684ab6fad747a5a93 https://git.kernel.org/stable/c/5474e6e17a262db45c60575c73f70210f5c7001f https://nvd.nist.gov/vuln/detail/CVE-2026-52952

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.