CVE-2026-80817: Linux Kernel IOMMU Race Condition Vulnerability

CVE-2026-80817 Overview

CVE-2026-80817 is a NULL pointer dereference vulnerability in the Linux kernel's iommu/iommufd subsystem. The flaw exists in iommufd_ioas_change_process(), which iterates every I/O Address Space (IOAS) area while assuming area->pages is non-NULL. A race with iopt_map_file_pages() can invalidate that assumption and crash the kernel.

Critical Impact
A local unprivileged process issuing concurrent ioctl calls against /dev/iommu can trigger a kernel NULL pointer dereference, resulting in denial of service on affected Linux systems.

Affected Products

Linux kernel builds containing the iommufd subsystem with iommufd_ioas_change_process()
Distributions shipping the vulnerable kernel prior to the fix commits 7596354, d616de4, d9635e2, and ffe6d37
Virtualization hosts using iommufd for VFIO passthrough workflows

Discovery Timeline

2026-09-04 - CVE-2026-80817 published to the National Vulnerability Database
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80817

Vulnerability Analysis

The vulnerability resides in drivers/iommu/iommufd/ioas.c at the iommufd_ioas_change_process() function. This routine walks every area tracked by an IOAS while holding only the per-IOAS iova_rwsem. It then dereferences area->pages under the assumption that the pointer is always populated.

That invariant does not hold. The map path iopt_map_pages() operates in two phases. First it creates the area, inserts it into the interval tree under iova_rwsem, and leaves area->pages as NULL. It then releases iova_rwsem and populates area->pages later under domains_rwsem.

Between those phases, a concurrent iommufd_ioas_change_process() can observe the freshly inserted area and dereference the NULL pages pointer. The reported oops shows a supervisor read fault at offset 0xc0 from a NULL base inside the function, terminating the calling task and destabilizing the kernel.

Root Cause

The root cause is a locking and initialization race between two writers of the IOAS interval tree. iopt_map_file_pages() publishes the area to the tree before area->pages is initialized, but iommufd_ioas_change_process() treats tree membership as sufficient proof that pages is valid. No secondary check or synchronization exists to bridge the window.

Attack Vector

A local user with access to the iommufd character device can trigger the race. The syzkaller-reported crash originates from iommufd_fops_ioctl reached through the standard ioctl syscall path. Repeatedly issuing map operations from one thread while another thread invokes the process-change ioctl produces the NULL dereference and kernel oops.

No verified exploit code is published. The upstream fix serializes the two paths so that iommufd_ioas_change_process() no longer observes areas with a NULL pages field. Refer to the upstream commits for the exact patch mechanics: Kernel Git Commit 7596354, Kernel Git Commit d616de4, Kernel Git Commit d9635e2, and Kernel Git Commit ffe6d37.

Detection Methods for CVE-2026-80817

Indicators of Compromise

Kernel oops entries containing BUG: kernel NULL pointer dereference with faulting address 0x00000000000000c0
Backtraces referencing iommufd_ioas_change_process+0x419 and iommufd_fops_ioctl in dmesg or /var/log/kern.log
Unexpected task terminations for processes performing ioctl calls against /dev/iommu

Detection Strategies

Monitor kernel log streams for Oops: events whose call trace originates in the iommufd subsystem.
Correlate crash events with processes opening /dev/iommu and issuing IOAS-related ioctl numbers.
Track kernel version and build identifiers across the fleet to identify hosts still running pre-patch iommufd code.

Monitoring Recommendations

Forward dmesg and kmsg output to a centralized logging pipeline and alert on iommufd stack frames.
Baseline which workloads legitimately use iommufd (typically VFIO device passthrough and userspace drivers) and flag unexpected callers.
Enable kernel crash dump collection (kdump) on virtualization hosts so future oops events can be analyzed offline.

How to Mitigate CVE-2026-80817

Immediate Actions Required

Apply the upstream fix by upgrading to a kernel that includes commits 7596354, d616de4, d9635e2, or ffe6d37, or the vendor backport that references them.
Inventory hosts that expose /dev/iommu to workloads and prioritize patching on multi-tenant systems.
Restrict access to the iommufd device node to trusted service accounts until the fix is deployed.

Patch Information

The fix is distributed across four stable-tree commits: Kernel Git Commit 7596354, Kernel Git Commit d616de4, Kernel Git Commit d9635e2, and Kernel Git Commit ffe6d37. Track your distribution's advisory feed for the corresponding package update and reboot affected hosts after installation.

Workarounds

Where iommufd is not required, disable the module and rely on the legacy VFIO container interface until patches are applied.
Constrain access to /dev/iommu using file permissions or LSM policies so only vetted processes can issue ioctl calls.
On virtualization hosts, avoid concurrent IOAS map and process-change operations from untrusted guests or userspace agents.

bash

# Verify running kernel and restrict iommufd device access
uname -r
ls -l /dev/iommu
chmod 0600 /dev/iommu
# Optionally prevent the module from loading until patched
echo 'blacklist iommufd' | sudo tee /etc/modprobe.d/iommufd-blacklist.conf