Linux kernel iommufd: hwpt replace responds to faults on the wrong domain, stranding faults on the old hwpt

Impact

iommufd_hwpt_replace_device() calls iommufd_auto_response_faults() with the *new* hwpt but the attach handle of the device's *old* domain. Fault groups are queued against the hwpt that was attached when the fault was delivered, so the scan looks in the wrong fault queue and outstanding I/O page-fault groups on the old domain are never auto-responded. The commit message identifies this as a refactor regression: the original fault.c code passed the old domain. In practice the device is left waiting on a page-fault response that will not come, with fault state leaked, on precisely the path a VMM or device-assignment agent uses when moving an assigned device between I/O page tables. That path is live on GPU nodes doing VFIO/iommufd passthrough of accelerators and SR-IOV NICs, and a device stuck in that state usually means draining the node rather than recovering it in place.

Who can reach it

Local and privileged: something must hold /dev/iommu and perform a hwpt replace on a fault-capable device - normally the hypervisor or device-assignment control plane, not an ordinary tenant workload. Not remotely reachable, and not reachable at all on hosts that do not use iommufd fault handling.

What to do

Update to a stable kernel carrying commits 564ac339, 8eb07702, adb87155 or ba5c0f28 and reboot each affected host; iommufd is built in, so there is no module-reload shortcut. The record names no fixed release number. Until then, avoiding hwpt replace on fault-capable domains avoids the affected path.

References

Related entries

• Linux kernel io_uring: eventfd signaled inline from a waitqueue wakeup handler can feed back into epollCVE-2026-80920 · Linux kernel io_uring (eventfd signaling on DEFER_TASKRUN rings)Unscored
• Linux crypto iaa: DMA buffer not unmapped before software fallback corrupts decompressed dataCVE-2026-80945 · Linux kernel crypto/iaa (Intel In-Memory Analytics Accelerator decompress path)Unscored
• Linux fuse io-uring: request headers copied from a non-whitelisted slab object panics hardened usercopyCVE-2026-80946 · Linux kernel FUSE io-uring transport (fuse_request header usercopy)Unscored
• Linux net/smc: connection freed before tasklet drain leaves a use-after-free on the SMC-D receive pathCVE-2026-80979 · Linux kernel net/smc (SMC-D connection teardown vs. rx tasklet)Unscored
• Linux kernel net/smc: oversized SMC-Rv2 LLC messages let a peer delete or install RDMA rkeysCVE-2026-80985 · Linux kernel net/smc (SMC-Rv2 LLC rkey handling)Unscored
• Linux kernel net/smc: out-of-bounds read parsing the v2 extension on every SMC-Rv2 link additionCVE-2026-80986 · Linux kernel net/smc (SMC-Rv2 add-link v2 extension parsing)Unscored