CVE-2026-89449: Linux Kernel IOMMU Memory Leak Vulnerability

CVE-2026-89449 Overview

CVE-2026-89449 is a memory leak vulnerability in the Linux kernel's Input/Output Memory Management Unit (IOMMU) subsystem. The flaw resides in the iommu_mock_device_add() function within drivers/iommu/iommu.c. When device_add() fails after a successful iommu_fwspec_init() call, the error path frees only the fwspec structure while leaving the outer dev->iommu structure allocated. Syzkaller fuzzing exposed the leak through repeated iommufd_test ioctl invocations against the mock IOMMU device.

Critical Impact
Repeated triggering of the failure path exhausts kernel memory over time, degrading system stability on hosts running kernel selftests or fuzz workloads.

Affected Products

Linux kernel versions containing the iommu_mock_device_add() implementation in drivers/iommu/iommu.c
Kernels exposing the iommufd selftest interface (drivers/iommu/iommufd/selftest.c)
Distributions shipping the affected upstream kernel prior to the fix commits

Discovery Timeline

2026-09-11 - CVE-2026-89449 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-89449

Vulnerability Analysis

The defect is a memory leak [CWE-401] in the IOMMU mock device registration path. iommu_mock_device_add() calls iommu_fwspec_init(), which allocates two structures on success: dev->iommu through dev_iommu_get() and the nested dev->iommu->fwspec. The function then calls device_add(dev). If device_add() returns an error, the cleanup path invokes only iommu_fwspec_free(dev). That helper releases the fwspec allocation but does not release the enclosing dev_iommu structure and does not clear the dev->iommu pointer.

Kmemleak reports a 192-byte leaked allocation originating from dev_iommu_get+0x10c/0x1a0 in drivers/iommu/iommu.c:408. Each failed device_add() invocation leaks one dev_iommu structure. Attackers with access to the iommufd ioctl interface can drive the leak through repeated IOMMU_TEST_OP_MOCK_DOMAIN operations from user space.

Root Cause

The error-handling path uses the wrong deallocation helper. iommu_fwspec_free() is scoped to release firmware specification data only. The correct helper for this failure path is dev_iommu_free(), which releases both the fwspec and the outer dev_iommu structure and clears dev->iommu to a known state.

Attack Vector

Local exploitation requires access to the iommufd character device and the ability to issue the selftest ioctl handled by iommufd_fops_ioctl(). A userspace process invokes iommufd_test() with the mock domain operation, causing mock_dev_create() to reach iommu_mock_device_add(). Forcing device_add() to fail (for example, under memory pressure or through Syzkaller-style fuzzing) leaks the dev_iommu allocation on every attempt.

The vulnerability does not provide code execution or privilege escalation. Sustained exploitation causes resource exhaustion of kernel slab memory. See the upstream fix commits (b7b0b385, eaf44262, and f80f3acb) for the corrected error path.

Detection Methods for CVE-2026-89449

Indicators of Compromise

Kmemleak reports referencing dev_iommu_get, iommu_fwspec_init, and iommu_mock_device_add in the allocation backtrace.
Growth in slab cache accounting for allocations of size 192 bytes attributable to the IOMMU subsystem.
Unexpected user-space processes issuing ioctl calls against /dev/iommu on production hosts.

Detection Strategies

Enable CONFIG_DEBUG_KMEMLEAK in test and staging kernels and scan /sys/kernel/debug/kmemleak for unreferenced objects tied to the IOMMU code path.
Monitor slabtop and /proc/slabinfo for sustained growth in generic kmalloc-192 caches on systems that expose iommufd.
Audit kernel build configuration to identify whether CONFIG_IOMMUFD_TEST or the mock IOMMU selftest is enabled outside of development environments.

Monitoring Recommendations

Collect telemetry on ioctl syscalls targeting /dev/iommu and alert on non-privileged callers or unusual volumes.
Track available kernel memory over time and alert on downward trends that do not correlate with workload changes.
Forward kernel ring buffer messages to a centralized log store to capture kmemleak and OOM events for correlation.

How to Mitigate CVE-2026-89449

Immediate Actions Required

Apply the upstream stable kernel commits b7b0b385, eaf44262, and f80f3acb that replace iommu_fwspec_free() with dev_iommu_free() in the failure path.
Rebuild production kernels without CONFIG_IOMMUFD_TEST if the selftest interface is not required.
Restrict access to /dev/iommu to trusted administrative accounts through standard file permissions and Linux Security Module policies.

Patch Information

The fix replaces iommu_fwspec_free(dev) with dev_iommu_free(dev) in the device_add() failure branch of iommu_mock_device_add(). dev_iommu_free() releases both the fwspec and the outer dev_iommu structure and clears dev->iommu. Distribution vendors are backporting the change to supported stable kernel branches identified in the referenced commits.

Workarounds

Disable the IOMMU mock selftest by unsetting CONFIG_IOMMUFD_TEST in the kernel configuration and rebuilding.
Remove or restrict the /dev/iommu device node on hosts that do not require IOMMU userspace management.
Apply seccomp or Linux Security Module policies that block ioctl operations against iommufd from untrusted processes.

bash

# Verify whether the mock IOMMU selftest is compiled into the running kernel
grep -E 'CONFIG_IOMMUFD_TEST|CONFIG_IOMMUFD' /boot/config-$(uname -r)

# Restrict access to the iommufd device node
chown root:root /dev/iommu
chmod 600 /dev/iommu

# Enable kmemleak scanning to confirm remediation
echo scan > /sys/kernel/debug/kmemleak
cat /sys/kernel/debug/kmemleak