CVE-2026-80633 Overview
CVE-2026-80633 is a Linux kernel vulnerability in the iommufd subsystem. The flaw occurs in the DMABUF release path, where iopt_release_pages() calls dma_buf_unpin() without holding the exporter's dma_resv lock. This violates a locking invariant enforced by dma_resv_assert_held() inside dma_buf_unpin(). The condition triggers a kernel warning whenever iommufd_ioas_destroy() or iommufd_ioas_unmap() releases the last reference on a DMABUF-backed iopt_pages object. A local, authenticated attacker with access to the iommufd interface can reach the vulnerable path through standard file descriptor close operations.
Critical Impact
Local privilege escalation potential through a locking invariant violation in the Linux kernel iommufd DMABUF release path, affecting host confidentiality, integrity, and availability.
Affected Products
- Linux kernel versions containing the iommufd DMABUF integration prior to the fix commit
- Distributions shipping the affected upstream iommufd subsystem
- Systems exposing /dev/iommu to non-root users or virtualization stacks
Discovery Timeline
- 2026-08-28 - CVE-2026-80633 published to NVD
- 2026-08-29 - Last updated in NVD database
Technical Details for CVE-2026-80633
Vulnerability Analysis
The defect resides in iopt_release_pages() within the Linux kernel iommufd subsystem. The function calls dma_buf_unpin() on a DMABUF attachment during teardown. The DMABUF core requires callers to hold the exporter's dma_resv reservation lock before invoking dma_buf_unpin(), an invariant asserted by dma_resv_assert_held(dmabuf->resv).
Because iopt_release_pages() did not acquire the lock, every teardown path that dropped the final reference on a DMABUF-backed iopt_pages object triggered a WARN at drivers/dma-buf/dma-buf.c:1137. The observed call chain reaches the fault via __x64_sys_close → __fput → iommufd_fops_release → iommufd_ioas_destroy → iopt_unmap_all → iopt_unmap_iova_range → iopt_release_pages → dma_buf_unpin.
The fix wraps dma_buf_unpin() in dma_resv_lock() and dma_resv_unlock() calls, matching the convention already used by iopt_map_dmabuf(). dma_buf_detach() acquires the reservation lock internally, so it remains outside the newly locked region.
Root Cause
The root cause is an improper locking sequence [CWE-667] in the iommufd release path. The kernel dropped the dma_resv lock invariant expected by the DMABUF exporter interface, producing an inconsistent synchronization state around pinned buffer accounting.
Attack Vector
Exploitation requires local access with permission to open the iommufd device and create DMABUF-backed I/O address space (IOAS) mappings. An attacker triggers the flawed path by closing the iommufd file descriptor or issuing an unmap request that releases the last reference on a DMABUF-backed iopt_pages. The resulting locking state corruption around pinned DMA buffers can be leveraged for host impact where DMABUF exporters and iommufd share references.
No verified exploit code is public. Refer to the upstream commits for the code-level fix.
Detection Methods for CVE-2026-80633
Indicators of Compromise
- Kernel WARNING entries in dmesg referencing dma_buf_unpin+0x62/0x70 at drivers/dma-buf/dma-buf.c:1137
- Stack traces containing iopt_release_pages, iopt_unmap_iova_range, and iommufd_ioas_destroy
- Unexpected iommufd_fops_release warnings correlated with process teardown of virtualization or DPDK workloads
Detection Strategies
- Ingest kernel logs into a centralized logging pipeline and alert on dma_buf_unpin WARN traces originating from iommufd
- Track kernel version and build metadata across the fleet to identify hosts running unpatched iommufd code
- Correlate iommufd file descriptor closures with kernel warnings to detect repeated triggering that may indicate probing
Monitoring Recommendations
- Forward /var/log/kern.log and journald kernel facility events to a SIEM for signature-based detection of the WARN trace
- Monitor processes that open /dev/iommu and audit which workloads create DMABUF-backed IOAS mappings
- Alert on repeated kernel WARN events on the same host within short intervals
How to Mitigate CVE-2026-80633
Immediate Actions Required
- Apply the upstream fix commit e745cd2c749e557c14a15ac931761c3f58c24489 or the stable backport cc69d0332421fd2943b66dbe5e597bf4fd5af126
- Update to a distribution kernel that includes the corrected iopt_release_pages() locking sequence
- Restrict access to /dev/iommu to trusted virtualization services and privileged users only
Patch Information
The fix takes the dma_resv lock around dma_buf_unpin() in iopt_release_pages(), matching the iopt_map_dmabuf() convention. dma_buf_detach() remains outside the locked region because it acquires the reservation lock internally. See the Kernel Git Commit Fix and the Kernel Git Commit Update for the exact code change.
Workarounds
- Remove or restrict permissions on /dev/iommu where iommufd DMABUF functionality is not required
- Disable workloads that create DMABUF-backed IOAS mappings until the kernel is patched
- Enforce panic_on_warn=0 only in test environments; production systems should be patched rather than configured to tolerate the WARN
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.