CVE-2026-89451 Overview
CVE-2026-89451 is a race condition in the Linux kernel's Shared Virtual Addressing (SVA) IOMMU subsystem. The flaw affects iommu_attach_device_pasid(), which installs a new SVA attach handle in the group Process Address Space ID (PASID) lookup before iommu_sva_bind_device() returns. A concurrent bind can locate and reuse the same handle after iommu_sva_lock is dropped, while handle->dev remains uninitialized. A subsequent call to iommu_sva_unbind_device() can then dereference a NULL dev pointer through handle->dev->iommu_group.
Critical Impact
Concurrent SVA bind and unbind operations can trigger a NULL pointer dereference in kernel space, leading to a kernel crash and local denial of service.
Affected Products
- Linux kernel versions containing the vulnerable iommu/sva handle initialization path
- Systems using IOMMU Shared Virtual Addressing with PASID support
- Distributions shipping kernels prior to the upstream fix commits
Discovery Timeline
- 2026-09-11 - CVE-2026-89451 published to the National Vulnerability Database
- 2026-09-11 - Last updated in NVD database
Technical Details for CVE-2026-89451
Vulnerability Analysis
The vulnerability is a race condition [CWE-362] in the Linux kernel IOMMU SVA code path. Shared Virtual Addressing allows devices to share the CPU virtual address space of a process using PASIDs. The kernel manages SVA state through per-group PASID lookup structures protected by iommu_sva_lock.
In the vulnerable flow, iommu_attach_device_pasid() publishes a new SVA handle into the group PASID lookup before iommu_sva_bind_device() finishes populating that handle. Once iommu_sva_lock is released, a second thread performing a concurrent bind can find the partially initialized handle and reuse it. The handle->dev field is set only after the lock is dropped, creating a window where a visible SVA handle exposes a NULL dev pointer to other threads.
A follow-on iommu_sva_unbind_device() call dereferences handle->dev->iommu_group on the racing thread. Because handle->dev is NULL, the dereference triggers a kernel oops and panics the system on typical configurations.
Root Cause
The root cause is incorrect ordering of visibility and initialization. Handle publication into the shared PASID lookup occurs before all critical fields are populated. The fix reorders the assignment so handle->dev is set before iommu_sva_lock is released, guaranteeing any concurrently visible handle is fully initialized.
Attack Vector
Exploitation requires local code execution with the ability to trigger SVA bind and unbind operations against a PASID-capable device. An unprivileged actor with access to a device that permits SVA operations can race two threads to reach the NULL dereference. The impact is denial of service via kernel crash; there is no indication of memory corruption suitable for privilege escalation in the referenced commits.
No public exploit code or proof-of-concept has been published for CVE-2026-89451. Refer to the upstream commits for the exact code paths involved.
Detection Methods for CVE-2026-89451
Indicators of Compromise
- Kernel oops or panic messages referencing iommu_sva_unbind_device or iommu_group in the call stack
- NULL pointer dereference traces originating from the drivers/iommu/iommu-sva.c code path
- Repeated crashes on hosts running workloads that heavily use PASID-based device sharing such as accelerators or GPUs
Detection Strategies
- Monitor dmesg and /var/log/kern.log for BUG or Oops entries containing iommu_sva symbols
- Correlate crash dumps captured by kdump with kernel version and IOMMU driver in use
- Track running kernel versions across the fleet and flag hosts that predate the fix commits 37a96a3, 530f8f9, 968e9a1, and bcffb1c
Monitoring Recommendations
- Ingest kernel logs into a centralized logging pipeline and alert on IOMMU-related panics
- Baseline expected SVA bind and unbind volumes for workloads that use accelerators
- Review vendor kernel changelogs and Linux distribution security trackers for backport availability
How to Mitigate CVE-2026-89451
Immediate Actions Required
- Inventory Linux hosts using IOMMU SVA and PASID-capable devices such as data-center accelerators
- Apply the upstream fix or the distribution kernel update that includes the referenced commits
- Reboot affected hosts after patching to load the corrected kernel image
Patch Information
The fix initializes handle->dev before releasing iommu_sva_lock, ensuring any visible SVA handle is fully populated. The change is present in the following upstream commits: Linux Kernel Commit 37a96a3, Linux Kernel Commit 530f8f9, Linux Kernel Commit 968e9a1, and Linux Kernel Commit bcffb1c.
Workarounds
- Restrict access to PASID-capable devices to trusted workloads until patches are applied
- Disable SVA on affected devices where operationally feasible using vendor driver parameters
- Isolate workloads that trigger frequent SVA bind and unbind cycles onto patched hosts first
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.