CVE-2026-89446 Overview
CVE-2026-89446 is a resource management flaw in the Linux kernel's iommufd subsystem. The function iommufd_take_all_iova_rwsem() acquires an object reference and the iova_rwsem write lock on an I/O Address Space (IOAS) before inserting it into a temporary ioas_list xarray. When xa_store() fails, the current IOAS is not yet present in ioas_list, so iommufd_release_all_iova_rwsem() cannot unwind the reference or the held rwsem. The result is a leaked object reference and a held write lock on failure paths.
Critical Impact
Failed xa_store() allocations leave the iova_rwsem write lock held and the IOAS object reference leaked, degrading iommufd availability.
Affected Products
- Linux kernel iommufd subsystem
- Stable trees receiving the referenced backport commits
- Distributions shipping vulnerable iommufd code paths
Discovery Timeline
- 2026-09-11 - CVE-2026-89446 published to NVD
- 2026-09-11 - Last updated in NVD database
Technical Details for CVE-2026-89446
Vulnerability Analysis
The iommufd subsystem manages IOAS objects that describe DMA address translation state for user-space assigned devices. The helper iommufd_take_all_iova_rwsem() walks the caller's IOAS set, taking an object reference and the iova_rwsem write lock on each entry before recording it in a temporary xarray for later release.
The defect appears on the failure path of xa_store(). If the xarray insertion fails for the current IOAS, that IOAS never enters ioas_list. The counterpart cleanup routine iommufd_release_all_iova_rwsem() iterates only over entries already stored in the xarray, so it skips the in-flight IOAS entirely. The reference count and the write lock acquired moments earlier remain held.
The upstream fix releases the current IOAS iova_rwsem and drops the reference before unwinding previously stored entries. See the Linux Kernel Commit 4c33d00 and companion backports.
Root Cause
The root cause is an incomplete error-handling path around lock acquisition and xarray storage. The code assumed successful insertion into ioas_list before relying on the cleanup routine to release resources. When xa_store() returns an error, the acquire-then-record sequence is broken, leaving state that no unwinder knows about.
Attack Vector
Exploitation requires local access to invoke iommufd operations, typically through a process with permission to open /dev/iommu and manage IOAS objects. Triggering the flaw depends on inducing xa_store() failure, most plausibly under memory pressure. Successful triggering leaks the IOAS reference and leaves the iova_rwsem write lock held, blocking subsequent IOAS operations and producing a denial-of-service condition on the affected iommufd context.
No verified public exploit code is available. Refer to the upstream commits for the exact call graph and fix.
Detection Methods for CVE-2026-89446
Indicators of Compromise
- Processes hanging indefinitely on iommufd ioctls waiting for iova_rwsem.
- Kernel hung_task warnings referencing iommufd_take_all_iova_rwsem or iova_rwsem.
- Rising IOAS object reference counts without corresponding release events.
- Kernel allocation failures (-ENOMEM) logged near iommufd operations.
Detection Strategies
- Audit installed kernel versions against the fix commits 07b4fe1, 4ac2ce1, and 4c33d00.
- Enable CONFIG_LOCKDEP and CONFIG_DEBUG_KMEMLEAK in test environments to surface stuck locks and leaked references.
- Monitor dmesg for INFO: task ... blocked for more than messages tied to iommufd call stacks.
Monitoring Recommendations
- Alert on kernel hung_task events on hosts running device-assignment workloads such as VFIO or virtualization stacks.
- Track memory-pressure metrics on hypervisors, since low-memory conditions increase the likelihood of xa_store() failure.
- Correlate iommufd ioctl error rates with per-process stall metrics to detect regressions after workload changes.
How to Mitigate CVE-2026-89446
Immediate Actions Required
- Apply the upstream kernel patches referenced by commits 07b4fe1, 4ac2ce1, and 4c33d00 to all affected hosts.
- Update to a distribution kernel that includes the iommufd: Release current IOAS on xa_store() failure fix.
- Restrict access to /dev/iommu to trusted service accounts and virtualization daemons.
Patch Information
The fix is available in stable trees via the following commits: Linux Kernel Commit 07b4fe1, Linux Kernel Commit 4ac2ce1, and Linux Kernel Commit 4c33d00. The patch releases the current IOAS iova_rwsem and object reference before unwinding previously stored xarray entries.
Workarounds
- Limit unprivileged access to iommufd interfaces where operationally feasible.
- Reduce memory pressure on hosts using iommufd to lower the probability of xa_store() failure until patches are deployed.
- Reboot affected hosts to clear leaked locks and references if the condition has already been triggered.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.