{"id":"CVE-2026-89445","title":"In the Linux kernel, the following vulnerability has been resolved:\n\niommufd: Fix UAF in selftest IOPF reporting\n\nIOMMUFD selftest TRIGGER_IOPF borrows an attach handle from\ngroup->pasid_array without synchronizing against PASID detach,\n…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\niommufd: Fix UAF in selftest IOPF reporting\n\nIOMMUFD selftest TRIGGER_IOPF borrows an attach handle from\ngroup->pasid_array without synchronizing against PASID detach,\n…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwe":["CWE-825"],"vendor":"Linux","product":"Linux","affected":["Linux >= ddee19971081b42615d62f4fdada21274708ed4d < fd2e7ac94d6d813548b021473c3dddc30c8c07d1","Linux >= ddee19971081b42615d62f4fdada21274708ed4d < cab2895729516799384d48560e6fca105fb3f927","Linux >= ddee19971081b42615d62f4fdada21274708ed4d < e27e90bde68b2ab92e63ed19caad1ef57188bea0","Linux >= ddee19971081b42615d62f4fdada21274708ed4d < 8c07df7cdfcf52f1ff276c588612aabc6c6b8399","Linux 6.11"],"published":"2026-09-11","updated":"2026-10-03","sourceUpdated":"2026-10-03T11:17:42.070","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89445","references":[{"url":"https://git.kernel.org/stable/c/8c07df7cdfcf52f1ff276c588612aabc6c6b8399","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cab2895729516799384d48560e6fca105fb3f927","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e27e90bde68b2ab92e63ed19caad1ef57188bea0","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fd2e7ac94d6d813548b021473c3dddc30c8c07d1","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89445.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-89445"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2532116"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89445"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89445"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89445.mbox"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"epss":0.00168,"epssPercentile":0.06065,"scores":{"nvd":8.8,"vendor":7,"cna":8.8},"ingestedAt":"2026-09-14T15:23:07.475Z","slug":"CVE-2026-89445","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niommufd: Fix UAF in selftest IOPF reporting\n\nIOMMUFD selftest TRIGGER_IOPF borrows an attach handle from\ngroup->pasid_array without synchronizing against PASID detach,\nthen a concurrent iommu_report_device_fault() can dereference\nthat borrowed handle's domain pointer after the detach erases\nthe handle and frees the backing struct iommufd_attach_handle.\nTRIGGER_IOPF then dereferences the freed handle, causing a UAF.\n\nFix by adding a iopf_rwsem in mock_dev to follow the expected design\nof a real driver. Hold its read side across the whole\niommu_report_device_fault() call, and its write side around every\npath that attaches, detaches, or replaces a device domain.\nThis can block new reports and drains in-flight reports before an old\nattach handle or the IOPF fault parameter can be removed.\nAlso take the write side while registering a mock device, since\nit can invoke the mock driver's default-domain attach callback.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · updated 2026-09-18 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89445.json)","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":215293,"id":"CVE-2026-89445","ts":1791027881829,"field":"cvss","old":"7","new":"8.8"},{"seq":207004,"id":"CVE-2026-89445","ts":1789749736458,"field":"cvss","old":"4.1","new":"7"},{"seq":207003,"id":"CVE-2026-89445","ts":1789749736458,"field":"severity","old":"medium","new":"high"},{"seq":202909,"id":"CVE-2026-89445","ts":1789403732903,"field":"cvss","old":"8.8","new":"4.1"},{"seq":202908,"id":"CVE-2026-89445","ts":1789403732903,"field":"severity","old":"high","new":"medium"},{"seq":198057,"id":"CVE-2026-89445","ts":1789384321583,"field":"cvss","old":"4.1","new":"8.8"},{"seq":198056,"id":"CVE-2026-89445","ts":1789384321583,"field":"severity","old":"medium","new":"high"},{"seq":183552,"id":"CVE-2026-89445","ts":1789356675855,"field":"cvss","old":"8.8","new":"4.1"},{"seq":183551,"id":"CVE-2026-89445","ts":1789356675855,"field":"severity","old":"high","new":"medium"},{"seq":153228,"id":"CVE-2026-89445","ts":1789285349636,"field":"cvss","old":null,"new":"8.8"},{"seq":153227,"id":"CVE-2026-89445","ts":1789285349636,"field":"severity","old":"none","new":"high"},{"seq":147728,"id":"CVE-2026-89445","ts":1789270212060,"field":"cvss","old":null,"new":"4.1"},{"seq":147727,"id":"CVE-2026-89445","ts":1789270212060,"field":"severity","old":"none","new":"medium"},{"seq":109492,"id":"CVE-2026-89445","ts":1789183732123,"field":"cvss","old":null,"new":"4.1"},{"seq":109491,"id":"CVE-2026-89445","ts":1789183732123,"field":"severity","old":"none","new":"medium"}]}