CVE-2026-89451 - Vulnerability Details

- iommu/sva: Set handle->dev before the SVA handle is visible

Description

In the Linux kernel, the following vulnerability has been resolved:

iommu/sva: Set handle->dev before the SVA handle is visible

iommu_attach_device_pasid() installs the new SVA attach handle in the
group PASID lookup before iommu_sva_bind_device() returns. A concurrent
bind can therefore find and reuse the same handle after iommu_sva_lock is
dropped.

handle->dev was initialized after dropping iommu_sva_lock. This leaves a
window where a racing bind can return a handle whose dev pointer is still
NULL. A subsequent iommu_sva_unbind_device() can then dereference it via
handle->dev->iommu_group.

Initialize handle->dev before releasing iommu_sva_lock so any visible SVA
handle is fully initialized.

Published: 2026-09-11

Score: 4.1 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability is a race condition in the Linux kernel's IOMMU SVA handling that can cause a NULL pointer dereference when a handle->dev pointer is accessed before being properly initialized, leading to a kernel crash and resulting in denial of service. The weakness is a null pointer dereference, classified as CWE-476. If exploited, the attacker could cause the system to panic, potentially requiring a reboot and leading to downtime.

Affected Systems

Affected systems: Linux kernel components that distributions using kernel code before the patch that ensures handle->dev is initialized prior to releasing iommu_sva_lock. Specific kernel release numbers are not listed, so all pre‑patch kernels are at risk.

Risk and Exploitability

The CVSS score of 4.1 indicates moderate severity, while the EPSS score of <1% suggests a low probability of exploitation. The flaw is not listed in the CISA KEV catalog, and the attack requires a race between privileged kernel operations, limiting exploitability to attackers with local or privileged access to trigger concurrent device bind/unbind sequences.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`be51b1d6bbff48c7d1943a8ff1e5a55777807f6e`	affected	< bcffb1c75da8fc9d51168ff9f09d471c26507912
`be51b1d6bbff48c7d1943a8ff1e5a55777807f6e`	affected	< 968e9a1f71140c86dc4092f6b361e997923f3813
`be51b1d6bbff48c7d1943a8ff1e5a55777807f6e`	affected	< 37a96a30617a4c96f048a5874c00509bc4fe4d85
`be51b1d6bbff48c7d1943a8ff1e5a55777807f6e`	affected	< 530f8f9c3546cb3ebee1b135375aaee08a073ebb

Linux

affected

Version	Status	Constraints
`6.2`	affected	—
`0`	unaffected	< 6.2
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[be51b1d6bbff48c7d1943a8ff1e5a55777807f6e,bcffb1c75da8fc9d51168ff9f09d471c26507912)`	affected	code_commit	—
`[be51b1d6bbff48c7d1943a8ff1e5a55777807f6e,968e9a1f71140c86dc4092f6b361e997923f3813)`	affected	code_commit	—
`[be51b1d6bbff48c7d1943a8ff1e5a55777807f6e,37a96a30617a4c96f048a5874c00509bc4fe4d85)`	affected	code_commit	—
`[be51b1d6bbff48c7d1943a8ff1e5a55777807f6e,530f8f9c3546cb3ebee1b135375aaee08a073ebb)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.2`	affected	generic	—
`[0,6.2)`	unaffected	generic	—
`[6.12.109,6.13.0)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a patched version that ensures handle->dev is initialized before releasing iommu_sva_lock.
If an immediate upgrade is not feasible, limit IOMMU usage to essential devices or disable IOMMU for non‑critical hardware to narrow the race window.
Monitor kernel logs for OOPS or panic events associated with iommu_sva_unbind_device and apply a hotfix or suspend affected devices as soon as a patch becomes available.

Generated by OpenCVE AI on September 13, 2026 at 03:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.002.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/37a96a30617a4c96f048a5874c00509bc4fe4d85
https://git.kernel.org/stable/c/530f8f9c3546cb3ebee1b135375aaee08a073ebb
https://git.kernel.org/stable/c/968e9a1f71140c86dc4092f6b361e997923f3813
https://git.kernel.org/stable/c/bcffb1c75da8fc9d51168ff9f09d471c26507912
https://nvd.nist.gov/vuln/detail/CVE-2026-89451
https://www.cve.org/CVERecord?id=CVE-2026-89451

History

Sat, 12 Sep 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89451 https://www.cve.org/CVERecord?id=CVE-2026-89451
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.1, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: iommu/sva: Set handle->dev before the SVA handle is visible iommu_attach_device_pasid() installs the new SVA attach handle in the group PASID lookup before iommu_sva_bind_device() returns. A concurrent bind can therefore find and reuse the same handle after iommu_sva_lock is dropped. handle->dev was initialized after dropping iommu_sva_lock. This leaves a window where a racing bind can return a handle whose dev pointer is still NULL. A subsequent iommu_sva_unbind_device() can then dereference it via handle->dev->iommu_group. Initialize handle->dev before releasing iommu_sva_lock so any visible SVA handle is fully initialized.
Title		iommu/sva: Set handle->dev before the SVA handle is visible
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/37a96a30617a4c96f048a5874c00509bc4fe4d85 https://git.kernel.org/stable/c/530f8f9c3546cb3ebee1b135375aaee08a073ebb https://git.kernel.org/stable/c/968e9a1f71140c86dc4092f6b361e997923f3813 https://git.kernel.org/stable/c/bcffb1c75da8fc9d51168ff9f09d471c26507912

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:43:16.730Z

Updated: 2026-09-11T19:43:16.730Z

Reserved: 2026-09-11T19:38:34.706Z

Link: CVE-2026-89451

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:25.727

Modified: 2026-09-11T20:19:25.727

Link: CVE-2026-89451

Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:43:16Z

Links: CVE-2026-89451 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-13T06:30:16Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object