CVE-2026-89449

iommu: Fix dev_iommu memory leak when device_add fails in iommu_mock_device_add

Published Sep 11, 2026 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

iommu: Fix dev_iommu memory leak when device_add fails in iommu_mock_device_add

iommu_mock_device_add() first calls iommu_fwspec_init(), which on
success allocates both dev->iommu (via dev_iommu_get()) and
dev->iommu->fwspec. If the subsequent device_add(dev) call fails,
the error path only calls iommu_fwspec_free(dev), which frees
fwspec but leaves dev->iommu still allocated.

This triggers the following kmemleak report when fuzzing with Syzkaller:

BUG: memory leak
unreferenced object 0xffff888011e0a200 (size 192):
comm "syz.1.1695", pid 24885, jiffies 4295222527
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 ad 4e ad de .............N..
ff ff ff ff 00 00 00 00 ff ff ff ff ff ff ff ff ................
backtrace (crc 25df5bb3):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4575 [inline]
slab_alloc_node mm/slub.c:4899 [inline]
__kmalloc_cache_noprof+0x47a/0x710 mm/slub.c:5415
kmalloc_noprof include/linux/slab.h:950 [inline]
kzalloc_noprof include/linux/slab.h:1188 [inline]
dev_iommu_get+0x10c/0x1a0 drivers/iommu/iommu.c:408
iommu_fwspec_init+0x288/0x4d0 drivers/iommu/iommu.c:3087
iommu_mock_device_add+0x46/0xb0 drivers/iommu/iommu.c:385
mock_dev_create drivers/iommu/iommufd/selftest.c:1025 [inline]
iommufd_test_mock_domain drivers/iommu/iommufd/selftest.c:1066 [inline]
iommufd_test+0x2f8a/0x6190 drivers/iommu/iommufd/selftest.c:2072
iommufd_fops_ioctl+0x367/0x540 drivers/iommu/iommufd/main.c:533
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl fs/ioctl.c:583 [inline]
__x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x116/0x800 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Fix this by calling dev_iommu_free(dev) instead of iommu_fwspec_free(dev)
in the device_add() failure path. dev_iommu_free() frees both fwspec
and the outer dev_iommu struct and clears dev->iommu.

Analysis

Technical impact

The flaw arises when the kernel attempts to add a mock IOMMU device and the subsequent device_add call fails. In that error path the firmware specification is freed, but the outer IOMMU structure allocated by dev_iommu_get() is not released. This leaves an orphaned memory allocation that kmemleak detects as a memory leak. Repeated failures can accumulate unreleased kernel objects, gradually consuming kernel memory and potentially destabilizing the system. The weakness is a classic case of an unreleased resource (CWE-772).

Affected Systems

Any Linux kernel that contains the iommu_mock_device_add routine and exposes the IOMMU mock interface is affected. Systems that compile with IOMMU mock support and allow the self‑test ioctl or any application that triggers a device_add on a mock adapter are at risk. The advisory does not list specific kernel versions, so any installationpatch code path.

Risk and Exploitability

A CVSS score of 5.5 indicates moderate severity, and an EPSS score of less than 1% indicates a very low likelihood of active exploitation. The vulnerability is not currently listed in the CISA KEV catalog. The attack vector is inferred to be a privileged local ioctl; an adversary with sufficient local privileges could repeatedly trigger the failure path, accumulate kernel memory usage, and potentially drive the system into a denial‑of‑service state. Because the flaw requires kernel code execution, it is unlikely to be widely exploitable without elevated access.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`2a918911ed3d0841923525ed0fe707762ee78844`	affected	< f80f3acb69164800051ecdee871b6b006cbc2e66
`2a918911ed3d0841923525ed0fe707762ee78844`	affected	< eaf44262af24810d16800b988c92dfce90f73370
`2a918911ed3d0841923525ed0fe707762ee78844`	affected	< b7b0b3851474883d4aba6ed72da87141204b23e5
`1daf67217b0d0bf88ef7208d7fbeefe2378c6590`	affected	—
`6.17.3`	affected	< 6.18

Linux

affected

Version	Status	Constraints
`6.18`	affected	—
`0`	unaffected	< 6.18
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[2a918911ed3d0841923525ed0fe707762ee78844,f80f3acb69164800051ecdee871b6b006cbc2e66)`	affected	code_commit	—
`[2a918911ed3d0841923525ed0fe707762ee78844,eaf44262af24810d16800b988c92dfce90f73370)`	affected	code_commit	—
`[2a918911ed3d0841923525ed0fe707762ee78844,b7b0b3851474883d4aba6ed72da87141204b23e5)`	affected	code_commit	—
`1daf67217b0d0bf88ef7208d7fbeefe2378c6590`	affected	code_commit	—
`[6.17.3,6.18)`	affected	semver	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`6.18`	affected	semver	—
`[0,6.18)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the patch which calls dev_iommu when device_add fails.
Disable or restrict access to the IOMMU mock device interface and its ioctl commands to prevent unauthorized triggering of device_add.
Monitor system logs for kmemleak messages indicating unreleased kernel objects and investigate any unexpected memory‑leak occurrences.
Verify that kernel builds do not compile with the IOMMU mock infrastructure if it is not needed in production environments.

Generated by OpenCVE AI on September 21, 2026 at 01:27 UTC.

Tracking

Advisories

Source	ID	Title
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.206% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/b7b0b3851474883d4aba6ed72da87141204b23e5
https://git.kernel.org/stable/c/eaf44262af24810d16800b988c92dfce90f73370
https://git.kernel.org/stable/c/f80f3acb69164800051ecdee871b6b006cbc2e66
https://nvd.nist.gov/vuln/detail/CVE-2026-89449
https://www.cve.org/CVERecord?id=CVE-2026-89449

History

Sep 12, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-772
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89449 https://www.cve.org/CVERecord?id=CVE-2026-89449
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sep 11, 2026 11:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: iommu: Fix dev_iommu memory leak when device_add fails in iommu_mock_device_add iommu_mock_device_add() first calls iommu_fwspec_init(), which on success allocates both dev->iommu (via dev_iommu_get()) and dev->iommu->fwspec. If the subsequent device_add(dev) call fails, the error path only calls iommu_fwspec_free(dev), which frees fwspec but leaves dev->iommu still allocated. This triggers the following kmemleak report when fuzzing with Syzkaller: BUG: memory leak unreferenced object 0xffff888011e0a200 (size 192): comm "syz.1.1695", pid 24885, jiffies 4295222527 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 ad 4e ad de .............N.. ff ff ff ff 00 00 00 00 ff ff ff ff ff ff ff ff ................ backtrace (crc 25df5bb3): kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline] slab_post_alloc_hook mm/slub.c:4575 [inline] slab_alloc_node mm/slub.c:4899 [inline] __kmalloc_cache_noprof+0x47a/0x710 mm/slub.c:5415 kmalloc_noprof include/linux/slab.h:950 [inline] kzalloc_noprof include/linux/slab.h:1188 [inline] dev_iommu_get+0x10c/0x1a0 drivers/iommu/iommu.c:408 iommu_fwspec_init+0x288/0x4d0 drivers/iommu/iommu.c:3087 iommu_mock_device_add+0x46/0xb0 drivers/iommu/iommu.c:385 mock_dev_create drivers/iommu/iommufd/selftest.c:1025 [inline] iommufd_test_mock_domain drivers/iommu/iommufd/selftest.c:1066 [inline] iommufd_test+0x2f8a/0x6190 drivers/iommu/iommufd/selftest.c:2072 iommufd_fops_ioctl+0x367/0x540 drivers/iommu/iommufd/main.c:533 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x116/0x800 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Fix this by calling dev_iommu_free(dev) instead of iommu_fwspec_free(dev) in the device_add() failure path. dev_iommu_free() frees both fwspec and the outer dev_iommu struct and clears dev->iommu.
Title		iommu: Fix dev_iommu memory leak when device_add fails in iommu_mock_device_add
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/b7b0b3851474883d4aba6ed72da87141204b23e5 https://git.kernel.org/stable/c/eaf44262af24810d16800b988c92dfce90f73370 https://git.kernel.org/stable/c/f80f3acb69164800051ecdee871b6b006cbc2e66