Linux kernel iommu/amd: every handled PPR fault leaks a PCI device reference

Impact

iommu_call_iopf_notifier() resolves the faulting requester with pci_get_domain_bus_and_slot(), which takes a reference, and neither the success path nor the abort path drops it. On an AMD host running accelerators that use PPR/IOPF page faulting, every single handled page-request leaks one struct pci_dev reference. The practical consequence is that the device can never be released: hot-unplug, driver unbind, VFIO teardown between tenants and SR-IOV VF teardown will hang or leave stale state, and the reference count grows without bound for the life of the boot. This is an availability and operational problem on a shared node rather than a memory-corruption primitive - the leak is upward, not a use-after-free. The same ownership bug was fixed years ago in the older ppr_notifier() path; the newer IOPF notifier was added separately and missed it.

Who can reach it

Local - any workload on the host that drives an accelerator using PPR/IOPF page faults triggers the leak simply by running. No authentication distinction and no deliberate attack is needed; ordinary tenant use of an AMD IOMMU PPR-capable device is enough.

What to do

Update to a stable kernel carrying the fix (four stable commits linked) and reboot the affected nodes. No module reload or runtime workaround clears already-leaked references. Affects only hosts with AMD IOMMU and PPR-capable devices in use, which narrows the reboot list. No fixed release number is given in the record.

References

Related entries

• Linux kernel RDMA/uverbs: legacy write() bundle has no ioctl method element, causing a NULL dereferenceCVE-2026-89505 · Linux kernel RDMA/uverbs (legacy write() path attr bundle method_elm)Unscored
• Linux kernel RDMA/uverbs: REG_MR ioctl passes NULL udata, crashing mthca, irdma and siwCVE-2026-89506 · Linux kernel RDMA/uverbs UVERBS_METHOD_REG_MR (missing UHW attribute; mthca, irdma, siw)Unscored
• Microsoft Hyper-V: vmswitch fails to validate guest OID requestsCVE-2021-28476 · Microsoft Hyper-VCritical
• Incus: instance snapshots bypass restricted.containers.lowlevel, giving command execution on the hostCVE-2026-48751 · Incus (instance snapshots ignore restricted.containers.lowlevel)Critical
• VMware ESXi (OpenSLP): Use-after-free in OpenSLP on port 427 - unauthenticated remote code execution on the hypervisorCVE-2020-3992 · VMware ESXi (OpenSLP)Critical
• Linux kernel mlx5_core kTLS RX offload: TLS RX resync list corruption: entries are moved by the resync handlerCVE-2021-47215 · Linux kernel mlx5_core kTLS RX offloadCritical