CVE-2026-89447: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-89447 Overview

CVE-2026-89447 is a Linux kernel vulnerability in the iommufd subsystem. The flaw resides in iommufd_access_notify_unmap(), which handles unmap notifications for IOMMU file descriptor accesses. Internal accesses lack an external unmap callback and are meant to be skipped, but the current logic calls iommufd_lock_obj() before checking whether the access is internal. When the lock succeeds and the entry is then skipped, the matching iommufd_put_object() never runs. This leaks the object reference taken by the lock, resulting in a kernel reference count imbalance in the IOMMU file descriptor path.

Critical Impact
Repeated triggering of the leaked reference path can prevent teardown of IOMMU objects, leading to resource exhaustion and instability in kernels exposing iommufd to userspace consumers such as VFIO.

Affected Products

Linux kernel versions containing the pre-fix iommufd_access_notify_unmap() logic
Distributions shipping stable kernels prior to the referenced fix commits
Virtualization hosts using iommufd with VFIO device passthrough

Discovery Timeline

2026-09-11 - CVE-2026-89447 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-89447

Vulnerability Analysis

The iommufd subsystem exposes IOMMU management to userspace and tracks access objects that observe DMA mappings. When a mapping is torn down, iommufd_access_notify_unmap() iterates the registered accesses and invokes their external unmap callback. Internal accesses have no such callback and must be skipped.

The defective control flow acquired the object reference via iommufd_lock_obj() before inspecting the internal flag. On success, the loop identified the entry as internal, continued to the next iteration, and bypassed the paired iommufd_put_object() used on the normal unmap path. Each iteration over an internal access therefore leaked one reference on the object.

Over time, leaked references keep iommufd objects alive past their intended lifetime. This can block release of associated IOMMU domains and pinned memory, producing local denial-of-service conditions on hosts that repeatedly perform map or unmap operations.

Root Cause

The root cause is an ordering defect between reference acquisition and eligibility checking, a class of Missing Release of Resource after Effective Lifetime ([CWE-772]) issue. The lock-then-check sequence created a code path where an acquired reference was never released for skipped entries.

Attack Vector

Exploitation requires local access to the iommufd interface, which is typically restricted to privileged users or virtualization services. A local actor able to drive repeated unmap notifications against internal accesses can accumulate leaked references and destabilize the host kernel. No remote attack vector is documented.

See the upstream fixes for the specific code changes: Kernel Git Commit 0dbcdf4, Kernel Git Commit 436189e, and Kernel Git Commit 50a66a6.

Detection Methods for CVE-2026-89447

Indicators of Compromise

Growing kernel memory usage attributable to iommufd objects without corresponding release events
IOMMU domains or pinned pages that fail to be freed after VFIO device detachment
Processes unable to close iommufd file descriptors cleanly due to lingering object references

Detection Strategies

Compare the running kernel version against the fixed commits listed in the kernel.org stable tree
Instrument or trace iommufd_lock_obj() and iommufd_put_object() call pairs to detect imbalance
Monitor /proc/slabinfo for unusual growth in iommufd-related slab caches

Monitoring Recommendations

Alert on repeated iommufd unmap operations from unprivileged workloads on virtualization hosts
Track kernel warning messages and reference-count debug output during VFIO device lifecycle events
Baseline memory consumption on hypervisor hosts and flag sustained growth tied to guest device passthrough churn

How to Mitigate CVE-2026-89447

Immediate Actions Required

Identify hosts running kernels with iommufd enabled and inventory workloads using VFIO passthrough
Apply the upstream stable kernel updates that reorder the internal-access check before iommufd_lock_obj()
Restrict access to /dev/iommu and related device nodes to trusted users and services

Patch Information

The fix moves the internal-access check ahead of the lock acquisition so skipped entries are never locked and no reference leak occurs. Patches are available in the stable Linux kernel tree at Kernel Git Commit 0dbcdf4, Kernel Git Commit 436189e, and Kernel Git Commit 50a66a6. Rebuild or upgrade to a distribution kernel that incorporates these commits.

Workarounds

Disable iommufd in kernel configuration where VFIO passthrough is not required
Limit permissions on iommufd device nodes to reduce the set of local users able to trigger the path
Reboot affected hosts to reclaim leaked references when patching cannot be performed immediately

bash

# Verify running kernel version and iommufd exposure
uname -r
ls -l /dev/iommu 2>/dev/null
grep -E 'CONFIG_IOMMUFD' /boot/config-$(uname -r)