CVE-2026-89445: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89445 Overview

CVE-2026-89445 is a use-after-free vulnerability in the Linux kernel's iommufd subsystem, specifically in the selftest IOPF (I/O Page Fault) reporting path. The flaw resides in the TRIGGER_IOPF selftest, which borrows an attach handle from group->pasid_array without synchronizing against PASID detach operations. A concurrent call to iommu_report_device_fault() can dereference the borrowed handle's domain pointer after detach has erased the handle and freed the backing struct iommufd_attach_handle. Exploitation requires local access with low privileges but yields high impact on confidentiality, integrity, and availability, with scope change to affected components.

Critical Impact
A local attacker with low privileges can trigger a race condition in the iommufd selftest path, leading to use-after-free memory corruption and potential kernel-level compromise.

Affected Products

Linux kernel builds that enable IOMMUFD selftest support
Kernel trees prior to commits 8c07df7, cab2895, and e27e90b
Distributions shipping vulnerable stable kernel versions with iommufd enabled

Discovery Timeline

2026-09-11 - CVE-2026-89445 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89445

Vulnerability Analysis

The vulnerability is a classic use-after-free (UAF) triggered by a race between IOPF reporting and PASID detach in the iommufd selftest infrastructure. The TRIGGER_IOPF code path retrieves an attach handle from group->pasid_array and then invokes iommu_report_device_fault() using that handle. Because no synchronization protects the handle across the reporting call, another thread can concurrently detach the PASID, remove the handle from the array, and free the underlying struct iommufd_attach_handle. The IOPF reporter then dereferences the freed handle's domain pointer, producing a UAF condition inside the kernel.

Root Cause

The root cause is missing synchronization between borrowing an attach handle and the lifecycle operations that destroy it. The mock driver used by IOMMUFD selftests did not model the reader/writer locking pattern that real IOMMU drivers use to guard fault-reporting state. As a result, handle references outlive their backing allocation.

Attack Vector

Exploitation requires local access to a system where the vulnerable IOMMUFD selftest interface is reachable. An attacker with low privileges executes concurrent attach, detach, and IOPF-triggering operations to win the race. Successful exploitation yields kernel memory corruption. The scope change indicates the impact can extend beyond the immediate vulnerable component into other kernel subsystems.

The upstream fix introduces an iopf_rwsem in the mock_dev structure. The kernel holds the read side across the entire iommu_report_device_fault() call and the write side around every attach, detach, or replace operation, as well as during mock device registration. This blocks new fault reports and drains in-flight reports before an attach handle or the IOPF fault parameter can be removed.

See the upstream commits for implementation details: Kernel Git Commit 8c07df7, Kernel Git Commit cab2895, and Kernel Git Commit e27e90b.

Detection Methods for CVE-2026-89445

Indicators of Compromise

Kernel oops or panic logs referencing iommu_report_device_fault, iommufd_attach_handle, or KASAN use-after-free reports in the iommufd subsystem
Unexpected process crashes or privilege escalation attempts originating from user-space processes interacting with /dev/iommu
Anomalous kernel memory allocator activity coinciding with IOMMUFD selftest operations

Detection Strategies

Enable KASAN (Kernel Address Sanitizer) on test and staging kernels to surface UAF conditions during fuzzing and CI runs
Monitor dmesg and journald for stack traces containing TRIGGER_IOPF, iopf, or iommufd symbols
Audit systems for the presence of CONFIG_IOMMUFD_TEST in production kernels, which should not normally be enabled

Monitoring Recommendations

Track kernel version inventory to identify hosts running affected stable kernel builds
Alert on kernel crashes and unexpected reboots on IOMMU-heavy workloads such as virtualization and SR-IOV hosts
Correlate local privilege escalation attempts with kernel fault telemetry across the fleet

How to Mitigate CVE-2026-89445

Immediate Actions Required

Apply the upstream kernel patches referenced by commits 8c07df7, cab2895, and e27e90b as soon as vendor-backported updates are available
Rebuild custom kernels without CONFIG_IOMMUFD_TEST in production environments where the selftest interface is not required
Restrict local access on multi-tenant hosts and audit users with permissions to interact with /dev/iommu

Patch Information

The fix has been merged into the mainline Linux kernel and backported to stable trees via three commits. Administrators should track distribution advisories from their kernel vendor and install the corresponding update packages. The patch introduces iopf_rwsem in mock_dev and holds the read side across iommu_report_device_fault() while acquiring the write side around every attach, detach, replace, and mock device registration path.

Workarounds

Disable IOMMUFD selftest support by rebuilding the kernel without CONFIG_IOMMUFD_TEST
Limit local shell access and restrict permissions on IOMMU device nodes to trusted administrators only
Isolate workloads that require iommufd functionality onto patched hosts until updates are deployed across the fleet

bash

# Verify whether IOMMUFD selftest support is compiled into the running kernel
grep CONFIG_IOMMUFD_TEST /boot/config-$(uname -r)

# Check current kernel version against vendor advisories
uname -r

# Restrict access to the iommufd device node
chmod 0600 /dev/iommu