Linux kernel (drivers/iommu/iommufd): Iommufd tears down the page-tracking state behind a dma-buf backed IOAS mapping

CVSS 8.8CVE-2026-74328Kernel, userspace & hypervisorcurated

Impact

Iommufd tears down the page-tracking state behind a dma-buf backed IOAS mapping while the exporter can still fire invalidation callbacks into it. A tenant can race that teardown into a use-after-free on the structure that decides which host pages its device is allowed to touch, which is a step toward host memory disclosure or a host kernel crash that takes the whole node down.

Who can reach it

A tenant container holding /dev/iommu together with a device fd under /dev/vfio/* sets up an IOAS mapping over a dma-buf (the vfio-pci BAR dma-buf export is the usual source), then races close/detach against the exporter's invalidation callback. No host root and no fabric access are needed - only the passthrough device nodes inside the container, on a kernel new enough to have iommufd dma-buf support.

What to do

Boot a stable kernel carrying the fix commits (0507fced / f2d70dbd); the kernel CNA published no fixed-version list for this one, so track the commits into your distro kernel. Interim: do not expose /dev/iommu directly to tenant containers - keep passthrough behind a VMM the operator controls - and do not enable the vfio-pci dma-buf export path for tenant-held devices.

References

https://git.kernel.org/stable/c/0507fcedbdcc87281ef8639c045fc9980363bbb6 https://git.kernel.org/stable/c/f2d70dbd3dcefa8e3c380beff9c31f5f033a4221 https://nvd.nist.gov/vuln/detail/CVE-2026-74328

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.