Linux kernel iommufd: reference leak on unmap when an internal access is skipped

UnscoredCVE-2026-89447Kernel, userspace & hypervisorcurated

Impact

iommufd_access_notify_unmap() locked the access object before testing whether it was an internal access, then skipped the entry without the matching put, leaking an object reference on every such unmap. Leaked references mean the object is never released, so repeated unmap activity by a local process holding /dev/iommu can pin kernel objects indefinitely - resource exhaustion, not memory corruption. iommufd is the path VFIO device passthrough uses, so this sits under GPU and NIC passthrough on hosts that have moved to it. The record describes no privilege-escalation or cross-tenant impact.

Who can reach it

Local process with access to the iommufd character device (typically the VMM or a privileged container doing device passthrough). No remote path.

What to do

Pick up a stable kernel with the reordered internal-access check and reboot the hosts, draining first. No fixed release numbers are given beyond the linked stable commits, and the record describes no mitigation short of restricting iommufd access.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-89447 https://git.kernel.org/stable/c/0dbcdf4473a614adbd732d567c9b39ac0e040e0c https://git.kernel.org/stable/c/436189ee4bb2c7c993b945d68570dd38c3e4349e https://git.kernel.org/stable/c/50a66a63d1c841ae6b28a4551f642c1bba4c9529

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.