Linux iommufd: use-after-free on a borrowed attach handle in the selftest IOPF path

Impact

The iommufd selftest TRIGGER_IOPF path borrows an attach handle from group->pasid_array without synchronizing against PASID detach, so a concurrent iommu_report_device_fault() can dereference the handle's domain after the detach has freed the backing struct iommufd_attach_handle. The fix adds an iopf_rwsem in mock_dev, held for read across the whole fault report and for write around every attach, detach, replace and mock device registration. The operator-relevant point is the scope: this lives in the mock driver reached only through the iommufd selftest interface, which requires CONFIG_IOMMUFD_TEST. A production kernel built without that option does not contain the affected code, and no equivalent flaw in the real iommufd attach path is claimed here. It is worth checking on hosts that do GPU and DPU passthrough only because iommufd is the passthrough control path and vendor or distro debug kernels sometimes enable the test option.

Who can reach it

Local user with access to the iommufd selftest interface on a kernel built with CONFIG_IOMMUFD_TEST. Not reachable on a stock production kernel without that option.

What to do

First confirm whether your kernel is built with CONFIG_IOMMUFD_TEST; if it is not, no action is needed. If it is - a debug or lab kernel - take the stable fix and reboot the node, or rebuild without the test option. The record names stable commits, not a released version.

References

Related entries

• Linux kernel vfio/pci: freed MSI permission table left in the device, giving use-after-free and double freeCVE-2026-89777 · Linux kernel vfio/pci (vdev->msi_perm dangling pointer on init failure)High
• Linux kernel qla2xxx: host_map btree updated without vport_slock in the format-1 path, corrupting the mapCVE-2026-89844 · Linux kernel scsi qla2xxx (report ID acquisition, vport_slock host_map)High
• Linux kernel qla2xxx: unexpected status IOCB for a non-SCSI handle causes a wild pointer dereferenceCVE-2026-89849 · Linux kernel qla2xxx (QLogic Fibre Channel HBA status IOCB fast path)High
• Linux kernel qla2xxx: re-initializing a queued work item on a repeated FC-NVMe abort corrupts the workqueue listCVE-2026-89860 · Linux kernel qla2xxx (FC-NVMe abort path, priv->abort_work)High
• KVM arm64 vgic-v3: unreferenced LPI iteration lets a freed vgic_irq be dereferenced while saving pending tablesCVE-2026-89913 · Linux kernel KVM arm64 vgic-v3 (vgic_v3_save_pending_tables LPI iteration)High
• KVM x86/mmu: lockless aging walk re-reads the rmap and can follow a pte_list_desc chain being freedCVE-2026-89928 · Linux kernel KVM x86/mmu (lockless rmap walk in kvm_rmap_age_gfn_range)High