CVE-2026-89447

iommufd: Avoid locking internal accesses during unmap

Published Sep 11, 2026 CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

iommufd: Avoid locking internal accesses during unmap

iommufd_access_notify_unmap() skips internal accesses because they do
not have an external unmap callback to invoke.

However, the current test calls iommufd_lock_obj() before checking
whether the access is internal. If iommufd_lock_obj() succeeds, the loop
then sees the internal access and continues, bypassing the matching
iommufd_put_object() used by the normal unmap path. This leaks the
object reference taken by iommufd_lock_obj().

Check for internal accesses first so skipped entries are never locked.

Analysis

Technical impact

The flaw in the Linux kernel IOMMU daemon (iommufd) occurs during an unmap operation. If an internal access is encountered, the routine skips the normal unmap callback but still holds a lock on the bypassed object, causing the reference count for that object to remain incremented. The net effect is a reference counting leak that can cause memory usage to grow beyond what a normal unmap would expend (CWE-911).

Affected Systems

All Linux kernel releases that do not include the commit that resolves the issue (0dbcdf4473a614adbd732d567c9b39ac0e040e0c). Any distribution shipping a kernel unchanged by this patch and that loads the iommufd module for IOMMU handling is affected.

Risk and Exploitability

The CVSS score of 4.4 indicates moderate severity. The EPSS score is below 1 % and the vulnerability is not listed in the CISA KEV catalog, implying a very low probability of exploitation in the wild. The likely attack vector is privileged kernel access, as the vulnerable code path is exercised only by kernel components. The exposed leak may lead to incremental resource consumption, but no direct denial‑of‑service or privilege escalation vector is documented.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`27b77ea5feaa8fcf385ea99ce757982b0ac9d1f0`	affected	< 436189ee4bb2c7c993b945d68570dd38c3e4349e
`27b77ea5feaa8fcf385ea99ce757982b0ac9d1f0`	affected	< 50a66a63d1c841ae6b28a4551f642c1bba4c9529
`27b77ea5feaa8fcf385ea99ce757982b0ac9d1f0`	affected	< 0dbcdf4473a614adbd732d567c9b39ac0e040e0c

Linux

affected

Version	Status	Constraints
`6.17`	affected	—
`0`	unaffected	< 6.17
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[27b77ea5feaa8fcf385ea99ce757982b0ac9d1f0,436189ee4bb2c7c993b945d68570dd38c3e4349e)`	affected	code_commit	—
`[27b77ea5feaa8fcf385ea99ce757982b0ac9d1f0,50a66a63d1c841ae6b28a4551f642c1bba4c9529)`	affected	code_commit	—
`[27b77ea5feaa8fcf385ea99ce757982b0ac9d1f0,0dbcdf4473a614adbd732d567c9b39ac0e040e0c)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`6.17`	affected	generic	—
`[0,6.17)`	unaffected	generic	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*)`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update your Linux kernel to 0dbcdf4473a614adbd732d567c9b39ac0e040e0c or later to close the reference count leak.
If a kernel upgrade is not possible, unload the iommufd module to prevent the vulnerable unmap logic from executing.
Observe system memory metrics and kernel logs for abnormal growth or frequent iommufd activity; apply general and patching other subsystems.

Generated by OpenCVE AI on September 21, 2026 at 01:28 UTC.

Tracking

Advisories

Source	ID	Title
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.219% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0dbcdf4473a614adbd732d567c9b39ac0e040e0c
https://git.kernel.org/stable/c/436189ee4bb2c7c993b945d68570dd38c3e4349e
https://git.kernel.org/stable/c/50a66a63d1c841ae6b28a4551f642c1bba4c9529
https://nvd.nist.gov/vuln/detail/CVE-2026-89447
https://www.cve.org/CVERecord?id=CVE-2026-89447

History

Sep 12, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-911
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89447 https://www.cve.org/CVERecord?id=CVE-2026-89447
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sep 11, 2026 11:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: iommufd: Avoid locking internal accesses during unmap iommufd_access_notify_unmap() skips internal accesses because they do not have an external unmap callback to invoke. However, the current test calls iommufd_lock_obj() before checking whether the access is internal. If iommufd_lock_obj() succeeds, the loop then sees the internal access and continues, bypassing the matching iommufd_put_object() used by the normal unmap path. This leaks the object reference taken by iommufd_lock_obj(). Check for internal accesses first so skipped entries are never locked.
Title		iommufd: Avoid locking internal accesses during unmap
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0dbcdf4473a614adbd732d567c9b39ac0e040e0c https://git.kernel.org/stable/c/436189ee4bb2c7c993b945d68570dd38c3e4349e https://git.kernel.org/stable/c/50a66a63d1c841ae6b28a4551f642c1bba4c9529