Linux kernel IOMMU core: unbalanced unmap accounting on the map error path with iommu_debug on

Impact

When a mapping fails partway through, the error path called iommu_unmap() - and therefore the iommu_debug unmap accounting - for a mapping the debug layer never recorded, leaving the tracking state unbalanced. NVD scores it 7.8 with a changed scope (S:C), which is consistent with a fault in the layer that enforces DMA isolation for VFIO GPU and NIC passthrough. That is the layer a GPU cloud depends on to keep a passed-through H100 or ConnectX from reading another tenant's memory, so a defect there deserves attention even when the trigger is narrow. The important qualifier: this only bites on kernels built with IOMMU debug tracking enabled, which is not a stock distro server configuration - check your kernel config before scheduling anything.

Who can reach it

Local user able to drive IOMMU map operations that can fail - a VFIO passthrough guest or a process holding a device FD - on a kernel built with iommu_debug enabled. No remote path.

What to do

First establish whether your kernels enable IOMMU debug tracking at all; if not, you are not exposed and no window is needed. If they do, take the stable fix and reboot the affected nodes, or rebuild without the debug option. On passthrough hosts a reboot means evacuating the guests holding the devices.

References

Related entries

• Linux kernel perf AUX buffer: missing aux_mutex in map_range lets a local user map a freed pageCVE-2026-64300 · Linux kernel perf ring buffer AUX area (map_range / rb_alloc_aux locking)High
• Linux kernel QAT crypto driver: oversized RSA CRT components overflow half-size DMA buffersCVE-2026-64304 · Linux kernel crypto qat driver (RSA CRT key setup, qat_rsa_setkey_crt)High
• Linux kernel Intel QAT: unlocked service_table walks can corrupt the list or use freed entriesCVE-2026-64305 · Linux kernel Intel QAT driver (adf service_table list locking)High
• Linux kernel BPF: LPM trie RCU annotations reject sleepable programs and spam lockdep warningsCVE-2026-64352 · Linux kernel BPF LPM trie (RCU annotations for sleepable programs)High
• Linux BPF: BTF repeated-field count overflow allows an out-of-bounds write on BPF_BTF_LOADCVE-2026-64354 · Linux kernel BPF BTF parser (btf_repeat_fields expansion)High
• Linux mm: shrinker_info teardown races with expansion, giving a double free of memcg shrinker mapsCVE-2026-64418 · Linux kernel memcg shrinker_info (alloc/teardown race with expand_shrinker_info)High