Linux kernel iommufd: current IOAS rwsem and reference leaked when the unwind path misses it

UnscoredCVE-2026-89446Kernel, userspace & hypervisorcurated

Impact

iommufd_take_all_iova_rwsem() takes an object reference and the iova_rwsem write lock before inserting the IOAS into a temporary xarray; if that insert fails, the unwind path only releases entries already in the xarray, so the current IOAS keeps both its reference and its write lock. A leaked write lock on the IOVA rwsem means subsequent operations on that address space block, which on a passthrough host shows up as a VMM or container hanging rather than as memory corruption. Reaching it requires the allocation failure in xa_store, so it is a low-probability error path, but the consequence is a stuck object that survives until reboot.

Who can reach it

Local process using iommufd (VMM or privileged container performing device passthrough), and only on an allocation failure in the kernel. No remote path.

What to do

Update to a stable kernel with the corrected unwind and reboot the affected hosts after draining. No fixed release numbers are stated beyond the linked stable commits.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-89446 https://git.kernel.org/stable/c/07b4fe1367f076886c1c47a19c70936138325087 https://git.kernel.org/stable/c/4ac2ce123824d5f885c868fa1f9f4d463141a2ba https://git.kernel.org/stable/c/4c33d00ad9a911e87ea222986f732ce072e3aa26

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.