CVE-2026-80894: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-80894 Overview

CVE-2026-80894 is a Linux kernel vulnerability in the iommufd subsystem. The flaw lives in iommufd_hwpt_replace_device(), which passes the wrong hardware page table (hwpt) argument to iommufd_auto_response_faults() during a domain replace operation. The function receives the new hwpt alongside the handle of the device's old domain, producing a parameter mismatch. Pending fault groups tracked on the old domain's fault list are not correctly scanned or responded to, since the routine inspects the new hwpt->fault structures instead of the old ones.

Critical Impact
Fault groups queued on the old domain are not auto-responded to during device domain replace, leaving stale entries in the iommufd fault delivery list and response xarray.

Affected Products

Linux kernel builds containing commit fb21b1568ada ("iommufd: Make attach_handle generic than fault specific")
Linux kernel iommufd subsystem with fault-capable hwpt attach/detach/replace support
Distributions shipping affected stable kernel branches prior to the fix commits

Discovery Timeline

2026-09-04 - CVE-2026-80894 published to the National Vulnerability Database
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80894

Vulnerability Analysis

The iommufd subsystem manages I/O Memory Management Unit (IOMMU) hardware page tables for user-space device assignment. When a device is switched from one hardware page table to another, iommufd_hwpt_replace_device() orchestrates the domain change and drains any outstanding page fault requests that were delivered under the previous domain.

The function iommufd_auto_response_faults(x, handle) scans x->fault's deliver list and response xarray for fault groups matching the supplied handle. Fault groups are queued under the hwpt that was attached at fault-delivery time. Because old_handle is captured before the domain switch, its associated fault groups live on old->fault, not on the new hwpt->fault.

The call site incorrectly passes the new hwpt as the first argument. The scan therefore targets the wrong fault structures and cannot find or drain the pending groups belonging to the old domain.

Root Cause

The issue is a refactoring regression. Commit b7d8833677ba ("iommufd: Fault-capable hwpt attach/detach/replace") introduced the helper as __fault_domain_replace_dev() in fault.c, correctly invoking iommufd_auto_response_faults(old, curr). A later refactor, commit fb21b1568ada ("iommufd: Make attach_handle generic than fault specific"), relocated the logic into iommufd_hwpt_replace_device() in device.c and swapped the first argument from old to hwpt. The change was unintentional and broke the invariant that the domain and its handle must match.

Attack Vector

The defect is reachable through the standard iommufd uAPI used by user-space device-assignment stacks such as VFIO consumers. Local processes with permission to invoke device replace operations on an assigned device can trigger the mismatched call path. The primary observable effect is stale entries and undelivered fault responses, which can lead to functional or state-tracking issues in the fault subsystem rather than a direct memory-safety compromise. No public exploit is available, and this CVE is not listed on the CISA Known Exploited Vulnerabilities catalog.

The fix passes old in place of hwpt, restoring the intended semantics. See the upstream commits 564ac33, 8eb0770, adb8715, and ba5c0f2 for the fix.

Detection Methods for CVE-2026-80894

Indicators of Compromise

Unexpected residual entries in iommufd fault deliver lists or response xarray after device domain replace operations.
Kernel logs referencing iommufd_hwpt_replace_device or unresolved IOMMU page-request events for assigned devices.
User-space device-assignment agents observing missing or delayed page-response acknowledgments after hwpt replacement.

Detection Strategies

Inventory Linux hosts running kernels that include commit fb21b1568ada but lack one of the listed fix commits (564ac33, 8eb0770, adb8715, ba5c0f2).
Correlate iommufd-consuming workloads such as VFIO device passthrough hosts and virtualization platforms with kernel build metadata to identify at-risk systems.
Use configuration management tooling to query uname -r and package versions against distribution advisories referencing CVE-2026-80894.

Monitoring Recommendations

Monitor dmesg and journal output for IOMMU fault handling anomalies on hosts performing device hot-attach or domain replace.
Track hypervisor and device-assignment control-plane errors that surface after guest device reconfiguration.
Ingest kernel and audit telemetry into a centralized data lake to spot deviations in iommufd behavior across the fleet.

How to Mitigate CVE-2026-80894

Immediate Actions Required

Apply the vendor-supplied kernel update that includes one of the fix commits: 564ac33, 8eb0770, adb8715, or ba5c0f2.
Prioritize patching on virtualization and device-passthrough hosts that rely on iommufd fault-capable hardware page tables.
Reboot affected systems after installing the updated kernel to load the corrected iommufd code path.

Patch Information

The fix modifies iommufd_hwpt_replace_device() in the iommufd subsystem to pass old instead of hwpt to iommufd_auto_response_faults(), restoring alignment between the domain and its handle. The fix is available in the mainline and stable kernel trees through the commits referenced above. Consult your Linux distribution's security tracker for the specific package versions that ship these commits.

Workarounds

Where kernel patching cannot be applied immediately, avoid runtime device-domain replace operations on iommufd-managed devices.
Restrict access to iommufd uAPI to trusted administrative processes and virtualization control planes.
Reduce reliance on fault-capable hardware page tables until patched kernels are deployed.

bash

# Verify kernel version and check for the iommufd fix commits
uname -r
# Example: query the distribution package manager for the running kernel
# Debian/Ubuntu
apt-cache policy linux-image-$(uname -r)
# RHEL/Fedora
rpm -q --changelog kernel | grep -iE 'iommufd|CVE-2026-80894' | head