CVE-2026-80687 Overview
CVE-2026-80687 is a locking flaw in the Linux kernel's iommufd/viommu subsystem. The function iommufd_vdevice_alloc_ioctl() acquires idev->igroup->lock and then validates the driver's vdevice_size against the core structure size using a WARN_ON_ONCE check. On failure, the code path jumps to out_put_idev, which sits below out_unlock_igroup, skipping the mutex_unlock() call. The igroup mutex remains held, deadlocking subsequent vDEVICE operations targeting the same group. The fix redirects the error path to out_unlock_igroup so the lock is released correctly.
Critical Impact
A local trigger of the size-validation error path leaves the igroup mutex permanently held, deadlocking further vDEVICE operations on the affected IOMMU group.
Affected Products
- Linux kernel (mainline) with iommufd/viommu support
- Stable kernel branches receiving the iommufd_vdevice_alloc_ioctl() code path
- Distributions shipping kernels prior to the referenced stable commits
Discovery Timeline
- 2026-08-28 - CVE-2026-80687 published to NVD
- 2026-08-28 - Last updated in NVD database
Technical Details for CVE-2026-80687
Vulnerability Analysis
The defect resides in iommufd_vdevice_alloc_ioctl() inside the iommufd virtual IOMMU (viommu) code. The function acquires idev->igroup->lock early to serialize allocation of a virtual device object bound to an IOMMU group. It then sanity-checks that the driver-provided vdevice_size matches the core structure size using WARN_ON_ONCE. When the size mismatch triggers, control transfers to the out_put_idev label, which is placed after the out_unlock_igroup label in the cleanup ladder. This ordering bypasses the mutex_unlock(&idev->igroup->lock) call. Any subsequent vDEVICE operation on that IOMMU group blocks indefinitely waiting for the mutex, producing a functional denial-of-service on the affected group.
Root Cause
The root cause is an incorrect goto target in an error handling ladder, resulting in a missed lock release. This is a classic cleanup-ordering bug where the error label sits outside the region protected by the unlock step. The upstream fix, referenced in commits 294b464, 339bd115, and ca9e49e, redirects the error branch to out_unlock_igroup so the mutex is dropped before releasing the idev reference.
Attack Vector
Exploitation requires local access with permission to invoke the iommufd ioctl interface, typically restricted to privileged users or processes managing VFIO passthrough. A caller supplies parameters that cause the vdevice_size guard to fail. Once the guard fires, the igroup mutex remains held, and further vDEVICE ioctls against that group hang. The impact is limited to availability of IOMMU group operations; there is no memory-safety corruption or code-execution primitive described in the fix commit.
No verified public exploit code is available. See the kernel commit 294b464 for the technical fix.
Detection Methods for CVE-2026-80687
Indicators of Compromise
- Kernel log entries containing WARN_ON_ONCE firing inside iommufd_vdevice_alloc_ioctl with a vdevice_size mismatch backtrace.
- Processes stuck in uninterruptible sleep (D state) while invoking iommufd ioctls against a specific IOMMU group.
- hung_task watchdog messages naming threads blocked on the igroup mutex.
Detection Strategies
- Monitor dmesg and /var/log/kern.log for WARN traces originating in drivers/iommu/iommufd/viommu.c.
- Correlate hung iommufd ioctl calls with prior warnings on the same IOMMU group as a strong indicator of the deadlock.
- Track kernel version and build fingerprints across the fleet to identify hosts running unpatched builds.
Monitoring Recommendations
- Forward kernel ring buffer events to a central logging pipeline for anomaly review.
- Alert on repeated hung_task_timeout_secs triggers referencing iommufd or IOMMU group mutexes.
- Inventory hosts using VFIO device passthrough or virtualization workloads that exercise the viommu code path.
How to Mitigate CVE-2026-80687
Immediate Actions Required
- Apply the stable kernel updates that include commits 294b464b2be7, 339bd11591593, and ca9e49e1c893 from the upstream tree.
- Rebuild or update distribution kernels to a version containing the fix and reboot affected hosts.
- Restrict access to /dev/iommu and related iommufd interfaces to trusted management processes only.
Patch Information
The fix is committed upstream and backported to stable branches. Reference the kernel commit 294b464, kernel commit 339bd115, and kernel commit ca9e49e. Track your distribution's security advisories for backported package versions.
Workarounds
- Limit invocation of the iommufd vDEVICE allocation ioctl to trusted, well-tested userspace components that supply the correct vdevice_size.
- Avoid loading or exposing viommu functionality on hosts where VFIO virtual IOMMU support is not required.
- Reboot affected hosts to clear a stuck igroup mutex if the deadlock has already been triggered, since the lock cannot be released at runtime.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.