Linux kernel arm-smmu-v3: device teardown frees the IOPF queue before the IRQ handler that uses it

Impact

arm_smmu_device_remove() freed the IOPF queue, destroyed the vmid_map and disabled the device by hand, while the IRQs and queues were devm managed. devm unwinds only after remove() returns, so the cleanup ran in the wrong order and the IOPF queue was freed while the event-queue IRQ whose handler uses it was still registered - a use-after-free window during SMMU teardown. The fix moves all of it under devm so the unwind order is correct, and is a stated prerequisite for fixing a Tegra241 CMDQV CMD_SYNC use-after-free, which is why this touches Arm-based GPU nodes (Grace-class platforms) specifically. Exposure is narrow: the path runs on SMMU driver unbind or module removal, which is a root action on a running node, not something a tenant can trigger.

Who can reach it

Local, root-equivalent: a process able to unbind the arm-smmu-v3 driver or remove the module. Not reachable by a tenant with a GPU pod, and not reachable over the network. Only Arm platforms with an SMMUv3 are affected; x86 hosts do not run this driver.

What to do

Take the fix from your distribution's stable kernel (commits linked). Deploying it requires a reboot, so drain and reboot each affected Arm node. Until then the practical mitigation is operational: do not unbind or unload the arm-smmu-v3 driver on a live node.

References

Related entries

• Linux kernel PCI/proc: config space read checked against the reader's credentials, not the opener'sCVE-2026-93206 · Linux kernel PCI procfs interface (proc_bus_pci_read CAP_SYS_ADMIN check)Unscored
• Microsoft Hyper-V: vmswitch fails to validate guest OID requestsCVE-2021-28476 · Microsoft Hyper-VCritical
• Incus: instance snapshots bypass restricted.containers.lowlevel, giving command execution on the hostCVE-2026-48751 · Incus (instance snapshots ignore restricted.containers.lowlevel)Critical
• VMware ESXi (OpenSLP): Use-after-free in OpenSLP on port 427 - unauthenticated remote code execution on the hypervisorCVE-2020-3992 · VMware ESXi (OpenSLP)Critical
• Linux kernel mlx5_core kTLS RX offload: TLS RX resync list corruption: entries are moved by the resync handlerCVE-2021-47215 · Linux kernel mlx5_core kTLS RX offloadCritical
• Linux kernel (drivers/nvme/host): The NVMe/RDMA initiator destroys the queue pair before the connection manager ID, soCVE-2021-47378 · Linux kernel (drivers/nvme/host)Critical