CVE-2026-89453: Linux Kernel IOMMU Privilege Escalation

CVE-2026-89453 Overview

CVE-2026-89453 is a memory leak vulnerability in the Linux kernel's AMD Input-Output Memory Management Unit (IOMMU) driver. The flaw resides in iommu_call_iopf_notifier(), which handles Peripheral Page Request (PPR) and I/O Page Fault (IOPF) events. The function looks up the requesting PCI device using pci_get_domain_bus_and_slot(), which increments the device's reference count. Neither the success path via iommu_report_device_fault() nor the abort path releases that reference. Every handled PPR request therefore leaks a PCI device reference. The same ownership rule was previously fixed for the legacy iommu_v2 path in commit 6cf0981c2233, but the newer IOPF notifier introduced the regression separately.

Critical Impact
Sustained PPR fault activity from PCI devices supporting Shared Virtual Addressing (SVA) causes unbounded reference count growth, blocking device teardown and enabling resource exhaustion over time.

Affected Products

Linux kernel builds using the AMD IOMMU driver with PPR/IOPF notifier support
Systems with PCI devices leveraging Process Address Space ID (PASID) and PPR
Distributions shipping kernels prior to the fixes referenced in commits 1de4443, af3b69b, cfc5c1b, and d1470e1

Discovery Timeline

2026-09-11 - CVE-2026-89453 published to the National Vulnerability Database
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-89453

Vulnerability Analysis

The AMD IOMMU driver dispatches PPR events to registered fault handlers through iommu_call_iopf_notifier(). To route the fault, the function resolves the requester ID to a struct pci_dev using pci_get_domain_bus_and_slot(). Per kernel PCI subsystem contract, that lookup returns the device with pci_dev_get() already applied, transferring an owned reference to the caller.

The handler forwards the fault to iommu_report_device_fault() and then returns without invoking pci_dev_put(). The abort path exhibits the same omission. Each handled PPR entry therefore increments the target device's reference count by one without a matching decrement. Over the lifetime of a workload that generates continuous page faults, the reference count grows without bound and pins the pci_dev structure in memory.

Root Cause

The defect is a resource management error [CWE-772: Missing Release of Resource after Effective Lifetime]. The IOPF notifier path, added after the original ppr_notifier() fix in commit 6cf0981c2233, was not audited for the same reference ownership semantics. The patch drops the PCI device reference after the PPR entry is handled, restoring symmetric acquire/release behavior.

Attack Vector

Exploitation requires the ability to generate PPR traffic on an AMD IOMMU-managed PCI device that supports PASID and SVA. In shared-tenant or virtualization environments, a workload that repeatedly triggers I/O page faults can accumulate leaked references, preventing device removal, driver unbind, or clean guest teardown. Sustained abuse produces a denial-of-service condition through kernel resource exhaustion. No memory disclosure or code execution primitive is associated with this issue.

Refer to the upstream commits for the exact source-level change:

Detection Methods for CVE-2026-89453

Indicators of Compromise

Growing pci_dev reference counts on devices bound to the AMD IOMMU with PASID enabled, visible through kernel debugging interfaces such as /sys/kernel/debug/.
Failures to unbind, hot-remove, or release PCI devices that previously served PPR traffic, often accompanied by hung task warnings.
Elevated slab memory attributable to pci_dev allocations on long-running AMD hosts servicing SVA-capable workloads.

Detection Strategies

Compare running kernel versions against distribution advisories referencing the upstream commits 1de4443, af3b69b, cfc5c1b, and d1470e1.
Correlate PPR fault volume from AMD IOMMU trace events with pci_dev reference count deltas over time to identify leaks.
Enable CONFIG_DEBUG_KOBJECT_RELEASE and kmemleak on test systems to catch missing pci_dev_put() calls during PPR workloads.

Monitoring Recommendations

Ingest kernel logs into a centralized analytics platform and alert on repeated PPR fault bursts tied to specific bus/device/function tuples.
Track slab consumption trends for PCI-related caches on AMD servers hosting virtualized or accelerator workloads.
Monitor device teardown latency and failed removal attempts as leading indicators of reference-count pinning.

How to Mitigate CVE-2026-89453

Immediate Actions Required

Inventory Linux hosts running AMD processors with IOMMU enabled and identify workloads that use PASID or SVA-capable PCI devices.
Apply vendor-supplied kernel updates that incorporate the upstream fixes as soon as they are available for your distribution.
Schedule reboots for affected hosts, prioritizing systems exhibiting rising PCI slab usage or PPR fault volumes.

Patch Information

The fix drops the PCI device reference after handling the PPR entry in iommu_call_iopf_notifier(), mirroring the earlier fix applied to the legacy ppr_notifier() path in commit 6cf0981c2233. Backports are tracked in the stable-tree commits 1de4443f85e4, af3b69b16383, cfc5c1b2caa1, and d1470e16c197. Consult your distribution's security advisories to confirm the specific kernel package version that contains the backport.

Workarounds

Disable AMD IOMMU PPR/IOPF handling on hosts that do not require SVA by adjusting kernel boot parameters, accepting the loss of PASID-dependent functionality.
Restrict deployment of workloads that generate high volumes of I/O page faults on unpatched hosts until updates are applied.
Reboot affected systems periodically as an interim measure to reset leaked reference counts on long-running servers.

bash

# Verify AMD IOMMU status and current kernel version on affected hosts
uname -r
dmesg | grep -i "AMD-Vi\|iommu"
cat /sys/class/iommu/*/devices/*/iommu_group/type 2>/dev/null