CVE-2026-89452: Linux Kernel IOMMU Use-After-Free Vulnerability

CVE-2026-89452 Overview

CVE-2026-89452 is a Linux kernel vulnerability in the Qualcomm MSM Input-Output Memory Management Unit (IOMMU) driver. The flaw resides in msm_iommu_probe(), which adds its devm-managed IOMMU object to the qcom_iommu_devices global list before completing sysfs registration and IOMMU core registration. When either iommu_device_sysfs_add() or iommu_device_register() fails, the probe returns without unwinding the list insertion. The driver core then frees the devm allocation, leaving a dangling pointer in the global list that subsequent walkers can dereference.

Critical Impact
A local attacker able to trigger probe failure conditions on an MSM IOMMU device can cause a use-after-free through a dangling qcom_iommu_devices list entry, leading to kernel memory corruption or privilege escalation.

Affected Products

Linux kernel builds that compile the iommu/msm driver (Qualcomm MSM platforms)
Stable kernel branches prior to the commits referenced in the fix
Downstream distributions and vendor kernels that ship the affected msm_iommu_probe() code path

Discovery Timeline

2026-09-11 - CVE-2026-89452 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89452

Vulnerability Analysis

The defect is a Use-After-Free (UAF) rooted in incorrect error-path ordering inside msm_iommu_probe(). During normal setup the driver performs three sequential registrations: it appends the IOMMU object to the global qcom_iommu_devices list, calls iommu_device_sysfs_add(), and finally invokes iommu_device_register(). The teardown sequence on failure does not mirror this setup order.

When iommu_device_sysfs_add() fails, the probe returns an error while the IOMMU object remains linked in qcom_iommu_devices. The kernel's devm infrastructure then releases the underlying allocation because probe failed. The list now contains a pointer to freed memory. Any later traversal of qcom_iommu_devices dereferences that stale entry.

A failure of iommu_device_register() produces the same dangling list entry and additionally leaves the sysfs device registered, compounding the inconsistent state. The fixed commits unwind sysfs registration and the global list insertion in reverse setup order on the affected failure paths.

Root Cause

The root cause is missing symmetric cleanup on probe error paths. Resource acquisition is not paired with release in reverse order, which violates standard kernel driver initialization discipline and produces a stale pointer in a globally reachable list.

Attack Vector

Exploitation requires local access on a system that instantiates the MSM IOMMU driver. An attacker who can influence conditions that cause iommu_device_sysfs_add() or iommu_device_register() to fail during probe can seed a dangling entry in qcom_iommu_devices. Subsequent kernel operations that iterate the list dereference freed memory, enabling denial of service or memory corruption with potential for kernel-mode code execution.

No verified exploitation code is available. Refer to the upstream fixes at kernel.org commit 535a2002, kernel.org commit 7f7074a8, and kernel.org commit f532401b for the corrected unwind logic.

Detection Methods for CVE-2026-89452

Indicators of Compromise

Kernel oops or panic messages referencing qcom_iommu_devices traversal or msm_iommu symbols in dmesg.
KASAN reports flagging use-after-free reads within IOMMU list-walking routines.
Repeated probe failure entries for the MSM IOMMU device followed by unexpected kernel faults.

Detection Strategies

Inventory running kernel versions across Qualcomm MSM-based hosts and compare against the patched stable releases referenced in the kernel.org commits.
Enable KASAN and lockdep in test builds to catch dangling list dereferences originating from qcom_iommu_devices.
Monitor journalctl -k for iommu_device_sysfs_add or iommu_device_register failure messages during boot or device hotplug.

Monitoring Recommendations

Forward kernel logs to a central log store and alert on IOMMU probe failures paired with subsequent kernel warnings.
Track kernel package versions through configuration management to identify hosts still running unpatched builds.
Correlate device driver load events with post-boot kernel faults to catch late-manifesting use-after-free conditions.

How to Mitigate CVE-2026-89452

Immediate Actions Required

Upgrade affected Linux kernels to a stable release containing the three referenced commits that unwind sysfs and global list state on probe failure.
Rebuild and redeploy any custom or vendor kernels that carry the vulnerable msm_iommu_probe() code.
Restrict local access on Qualcomm MSM platforms until patched kernels are deployed, since the attack vector is local.

Patch Information

The upstream fix reorders the error paths in msm_iommu_probe() to remove the IOMMU object from qcom_iommu_devices and to tear down the sysfs device when iommu_device_sysfs_add() or iommu_device_register() fails. Apply the patches referenced in kernel.org commit 535a2002, kernel.org commit 7f7074a8, and kernel.org commit f532401b, or install a distribution kernel that backports them.

Workarounds

Disable the msm_iommu driver on systems that do not require it by blacklisting the module in /etc/modprobe.d/.
Limit exposure of Qualcomm MSM hardware to trusted local users where kernel updates cannot be applied immediately.
Enforce standard local hardening controls such as restricted shell access and mandatory access control policies to reduce the attacker population.

bash

# Verify running kernel and confirm patched version is installed
uname -r

# Blacklist the msm_iommu module as a temporary workaround
echo "blacklist msm_iommu" | sudo tee /etc/modprobe.d/disable-msm-iommu.conf
sudo update-initramfs -u