Linux kernel dma-heap: failed copy_to_user leaks an already-installed dma-buf fd for process lifetime

Impact

DMA_HEAP_IOCTL_ALLOC installed the file descriptor into the caller's fd table before copying the result back to userspace. If that final copy_to_user() fails - which a local process can force reliably by mprotect()ing the argument page read-only between the copy-in and copy-out - the fd and its underlying dma-buf reference stay alive and pinned for the life of the process while userspace never learns the number. Repeating the ioctl leaks one dma-buf per call, so a local user can pin DMA heap memory until the process exits, which on a shared node is a denial-of-service against other workloads on the same host. Exposure depends on whether /dev/dma_heap/* is present and reachable; a typical GPU compute node with no dma-heap devices exposed to tenants is not affected.

Who can reach it

Local unprivileged user with an open handle on a /dev/dma_heap/<name> device. No remote or network path; no privilege escalation, the gain is pinned memory.

What to do

Take the stable kernel fix that restructures the allocation path so get_unused_fd_flags() reserves the number and fd_install() happens last (commits linked in the record). Applying it means booting a patched kernel, so each node must be drained and rebooted; livepatch is unlikely to cover the restructured ioctl path. If dma-heap devices are not exposed to tenants on your nodes, this can wait for the next scheduled kernel roll.

References

Related entries

• Linux kernel arm-smmu-v3: device teardown frees the IOPF queue before the IRQ handler that uses itCVE-2026-93205 · Linux kernel iommu/arm-smmu-v3 (teardown ordering in arm_smmu_device_remove)Unscored
• Linux kernel PCI/proc: config space read checked against the reader's credentials, not the opener'sCVE-2026-93206 · Linux kernel PCI procfs interface (proc_bus_pci_read CAP_SYS_ADMIN check)Unscored
• Linux kernel SCSI core: blocking tag allocation during error recovery can deadlock the EH threadCVE-2026-93781 · Linux kernel SCSI core (scsi_eh_lock_door tag allocation)Unscored
• Linux kernel BPF: sysctl value replaced by a BPF program is not NUL-terminated, giving out-of-bounds readsCVE-2026-97420 · Linux kernel BPF (bpf_sysctl_set_new_value replacement buffer)Unscored
• Linux kernel net/rds: unprivileged container reads every RDS socket and connection on the hostCVE-2026-97476 · Linux kernel net/rds RDS_INFO_* getsockopt (missing netns filtering)Unscored
• Linux kernel net/rds: RDS-over-IB shutdown sleeps in a shared worker and hangs fabric teardownCVE-2026-97491 · Linux kernel net/rds over InfiniBand (rds_ib_conn_path_shutdown sleeping in the shutdown worker)Unscored