CVE-2026-52952: Linux Kernel Use-After-Free Vulnerability

CVE-2026-52952 Overview

CVE-2026-52952 is a Linux kernel vulnerability in the Input/Output Memory Management Unit (IOMMU) subsystem. The flaw resides in __iommu_group_set_domain_internal(), where concurrent domain attachments are rejected when any device in the group is recovering. This rejection logic triggers a WARN_ON in __iommu_group_set_domain_nofail() and can lead to a use-after-free (UAF) condition when pci_dev_reset_iommu_done() re-attaches group->domain. The issue affects nofail teardown paths such as __iommu_group_set_core_domain and __iommu_release_dma_ownership, where the domain is freed while group->domain still references it.

Critical Impact
Concurrent IOMMU domain attachment during PCI device reset can produce a use-after-free in kernel memory, risking kernel instability or local privilege escalation.

Affected Products

Linux kernel (mainline) — IOMMU subsystem
Stable kernel branches receiving the fix commits 5474e6e17a26 and 8fc289e809f3
Systems using PCI devices subject to DMA alias quirks or device reset flows

Discovery Timeline

2026-06-24 - CVE-2026-52952 published to the National Vulnerability Database (NVD)
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-52952

Vulnerability Analysis

The defect lives in the Linux kernel IOMMU group management code. __iommu_group_set_domain_internal() enforces a recovery fence: when any device in an IOMMU group is recovering, the function rejects concurrent domain attachments. This fence exists because multi-device groups can share the same Requester ID (RID) due to PCI Direct Memory Access (DMA) alias quirks, and concurrent attaches must be serialized.

The rejection path is incompatible with callers that pass the IOMMU_SET_DOMAIN_MUST_SUCCEED flag. Callers such as __iommu_group_set_core_domain() and __iommu_release_dma_ownership() operate on detach and teardown paths where the previously attached domain will be freed regardless of outcome. Rejecting the operation leaves group->domain pointing at a domain that the caller then frees, producing a dangling pointer.

When pci_dev_reset_iommu_done() subsequently re-attaches group->domain after the device reset completes, the kernel dereferences freed memory, yielding a UAF [CWE-416 class] and the observed WARN_ON.

Root Cause

The recovery_cnt fence in __iommu_group_set_domain_internal() does not honor the IOMMU_SET_DOMAIN_MUST_SUCCEED flag. Nofail callers are incorrectly blocked, so group->domain is never updated before the domain it references is released elsewhere in the teardown path.

Attack Vector

Exploitation requires the ability to trigger concurrent IOMMU domain operations and PCI device reset on a multi-device IOMMU group. The vector is local and contingent on kernel-resident reset paths. The EPSS probability is approximately 0.162%, reflecting low observed exploitation likelihood.

The vulnerability mechanism is described in the upstream patch commits. See the Kernel Git Commit 5474e6e17a26 and Kernel Git Commit 8fc289e809f3 for the authoritative source-level change.

Detection Methods for CVE-2026-52952

Indicators of Compromise

Kernel log entries containing WARN_ON traces originating in __iommu_group_set_domain_nofail().
KASAN or SLUB debug reports flagging use-after-free in IOMMU group structures following pci_dev_reset_iommu_done().
Unexpected kernel oops or panic correlated with PCI Function Level Reset (FLR) on devices in multi-device IOMMU groups.

Detection Strategies

Audit dmesg and persistent kernel logs for the specific WARN_ON signature in the IOMMU set-domain path.
Run kernels with KASAN enabled in test environments to surface UAF conditions in IOMMU teardown sequences.
Inventory hosts with PCI devices that share RID via DMA alias quirks and prioritize them for patch verification.

Monitoring Recommendations

Forward kernel ring buffer and journald events to a centralized log platform and alert on WARN_ON plus iommu keyword co-occurrence.
Track PCI reset events from pcieport and IOMMU driver modules (intel-iommu, amd_iommu) for abnormal frequency.
Correlate node crashes with kernel build identifiers to confirm whether affected hosts have received the upstream fix.

How to Mitigate CVE-2026-52952

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by commits 5474e6e17a26 and 8fc289e809f3 from the stable tree.
Update to a distribution kernel package that includes the IOMMU recovery fence fix.
Reboot affected hosts after patching to ensure the corrected IOMMU code paths are loaded.

Patch Information

The fix honors the IOMMU_SET_DOMAIN_MUST_SUCCEED flag, allowing nofail callers to pass the group->recovery_cnt fence and update group->domain correctly. A new gdev->blocked check is added to the device iteration loop to prevent concurrent per-device detachment. Patch sources: Kernel Git Commit 5474e6e17a26 and Kernel Git Commit 8fc289e809f3.

Workarounds

Avoid initiating PCI device resets on multi-device IOMMU groups until the kernel is patched.
Where feasible, disable or unbind drivers that trigger pci_dev_reset_iommu_done() on affected hardware.
Restrict local user access to interfaces that can trigger IOMMU domain reattachment, such as VFIO passthrough.

bash

# Verify the running kernel and confirm the fix is present
uname -r
git -C /usr/src/linux log --oneline | grep -E "5474e6e17a26|8fc289e809f3"