Linux kernel iommufd: NULL dereference racing IOAS change_process against a file-backed mapping

Impact

iommufd_ioas_change_process() walks every IOAS area holding only iova_rwsem and assumes each area has a non-NULL pages pointer. iopt_map_pages() works in two phases: it inserts the area into the interval tree under iova_rwsem with area->pages still NULL, then drops that lock and fills pages under domains_rwsem. In that window a concurrent change_process ioctl observes the half-built area and oopses on the NULL pages pointer, as the included syzkaller trace from iommufd_fops_ioctl shows. iommufd is the modern path for device passthrough, so this is reachable from whoever holds an iommufd file descriptor - the VMM handling GPU or NIC assignment. The outcome in the record is a kernel oops, i.e. a crash of the host that is running assigned-device guests; nothing in the description establishes exploitability beyond that.

Who can reach it

Local process holding an iommufd file descriptor - typically the VMM or device-assignment agent on a passthrough host - issuing IOAS change_process concurrently with a file-backed page mapping. Requires whatever privilege your setup needs to open /dev/iommu; no remote path.

What to do

Apply the stable kernel fix on hosts using iommufd for device passthrough. Kernel change, so drain the guests and reboot each host onto the patched kernel unless you livepatch. There is no configuration toggle short of not using the change_process ioctl, which is not under your control if the VMM issues it.

References

Related entries

• Linux kernel tegra241-cmdqv: use-after-free issuing CMD_SYNC on a freed command queue at teardownCVE-2026-80818 · Linux kernel iommu/tegra241-cmdqv (NVIDIA Grace SMMUv3 command-queue virtualization)Unscored
• Linux kernel virtio-crypto: unbounded device-reported result length over-reads guest kernel heapCVE-2026-80836 · Linux kernel virtio-crypto akcipher completion path (virtio_crypto_dataq_akcipher_callback)Unscored
• Linux KVM SEV: sub-page command buffer on SNP hosts triggers RMP faults and host panicCVE-2026-80853 · Linux KVM SEV (temporary buffer for {DE,EN}CRYPT ops on SNP-enabled hosts)Unscored
• Linux kernel FUSE: abort_on_kill returns without waiting for FR_FINISHED, freeing an in-flight requestCVE-2026-80857 · Linux kernel FUSE request handling (request_wait_answer abort_on_kill path)Unscored
• Linux kernel nvme-tcp: unserialized page_frag_cache corrupts page refcounts and panics the hostCVE-2026-80862 · Linux kernel nvme-tcp (page_frag_cache used unserialized for per-request PDU preallocation)Unscored
• Linux kernel bpf: copy_user_syms calls __get_user on a userspace pointer array with no access_ok checkCVE-2026-80865 · Linux kernel BPF kprobe_multi attach (copy_user_syms)Unscored