Linux iommufd: use-after-free on a borrowed attach handle in the selftest IOPF path

Impact

The iommufd selftest TRIGGER_IOPF path borrows an attach handle from group->pasid_array without synchronizing against PASID detach, so a concurrent iommu_report_device_fault() can dereference the handle's domain after the detach has freed the backing struct iommufd_attach_handle. The fix adds an iopf_rwsem in mock_dev, held for read across the whole fault report and for write around every attach, detach, replace and mock device registration. The operator-relevant point is the scope: this lives in the mock driver reached only through the iommufd selftest interface, which requires CONFIG_IOMMUFD_TEST. A production kernel built without that option does not contain the affected code, and no equivalent flaw in the real iommufd attach path is claimed here. It is worth checking on hosts that do GPU and DPU passthrough only because iommufd is the passthrough control path and vendor or distro debug kernels sometimes enable the test option.

Who can reach it

Local user with access to the iommufd selftest interface on a kernel built with CONFIG_IOMMUFD_TEST. Not reachable on a stock production kernel without that option.

What to do

First confirm whether your kernel is built with CONFIG_IOMMUFD_TEST; if it is not, no action is needed. If it is - a debug or lab kernel - take the stable fix and reboot the node, or rebuild without the test option. The record names stable commits, not a released version.

References

Related entries

• Linux kernel mlx5_core representor TC path + net/sched tc extension: The TC_SKB_EXT skb extension is not zeroedCVE-2021-47136 · Linux kernel mlx5_core representor TC path + net/sched tc extensionHigh
• Linux kernel (net/tls): When a BPF socket policy shrinks the plaintext after the ciphertext length was computed, kTLSCVE-2025-38608 · Linux kernel (net/tls)High
• Linux kernel libceph: truncated monitor reply decodes stale bytes from the reused bufferCVE-2026-68433 · Linux kernel libceph (MON_GET_VERSION_REPLY decode bound)High
• sudo: intercept policy checks skipped for execveat, letting allowed users run denied commandsCVE-2026-82474 · sudo (ptrace-based intercept mode, execveat/fexecve path)High
• Linux kernel (arch/x86/kvm/svm): Hardware ignores the low five bits of CR3 when loading PDPTEs, but KVM's nested SVMCVE-2024-50115 · Linux kernel (arch/x86/kvm/svm)High
• Linux kernel arm_ffa: unvalidated notification layout drives out-of-bounds read of the shared RX bufferCVE-2026-64081 · Linux kernel arm_ffa (Arm FF-A framework notification parsing)High