CVE-2026-89451

iommu/sva: Set handle->dev before the SVA handle is visible

Published Sep 11, 2026 CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

iommu/sva: Set handle->dev before the SVA handle is visible

iommu_attach_device_pasid() installs the new SVA attach handle in the
group PASID lookup before iommu_sva_bind_device() returns. A concurrent
bind can therefore find and reuse the same handle after iommu_sva_lock is
dropped.

handle->dev was initialized after dropping iommu_sva_lock. This leaves a
window where a racing bind can return a handle whose dev pointer is still
NULL. A subsequent iommu_sva_unbind_device() can then dereference it via
handle->dev->iommu_group.

Initialize handle->dev before releasing iommu_sva_lock so any visible SVA
handle is fully initialized.

Analysis

Technical impact

The flaw is a race condition in the Linux IOMMU SVA handler that allows a handle->dev pointer to remain NULL when a bind operation returns. When an unbind later dereferences that NULL pointer, the kernel crashes with a panic. This kernel crash results in a denial of service for the host system. The weakness corresponds to CWE‑476 – NULL Pointer Dereference.

Affected Systems

All Linux kernel releases that have not yet incorporated the commit moving handle->dev initialization above the iommu_sva_lock release are affected. The vendor list only mentions Linux and the affected component regardless of distribution.

Risk and Exploitability

The CVSS score of 4.1 indicates moderate severity, while the EPSS score of <1% points to a low exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. The race occurs between concurrent bind and unbind operations on the IOMMU SVA handle. Based on the description, it is inferred that such a race may require local or privileged privileges, but the CVE data does not explicitly state the required level of access.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`be51b1d6bbff48c7d1943a8ff1e5a55777807f6e`	affected	< c4c71368bc5c5b3840590d39b4cfa12d733cadf4
`be51b1d6bbff48c7d1943a8ff1e5a55777807f6e`	affected	< bcffb1c75da8fc9d51168ff9f09d471c26507912
`be51b1d6bbff48c7d1943a8ff1e5a55777807f6e`	affected	< 968e9a1f71140c86dc4092f6b361e997923f3813
`be51b1d6bbff48c7d1943a8ff1e5a55777807f6e`	affected	< 37a96a30617a4c96f048a5874c00509bc4fe4d85
`be51b1d6bbff48c7d1943a8ff1e5a55777807f6e`	affected	< 530f8f9c3546cb3ebee1b135375aaee08a073ebb

Linux

affected

Version	Status	Constraints
`6.2`	affected	—
`0`	unaffected	< 6.2
`6.6.160`	unaffected	≤ 6.6.*
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[be51b1d6bbff48c7d1943a8ff1e5a55777807f6e,bcffb1c75da8fc9d51168ff9f09d471c26507912)`	affected	code_commit	—
`[be51b1d6bbff48c7d1943a8ff1e5a55777807f6e,968e9a1f71140c86dc4092f6b361e997923f3813)`	affected	code_commit	—
`[be51b1d6bbff48c7d1943a8ff1e5a55777807f6e,37a96a30617a4c96f048a5874c00509bc4fe4d85)`	affected	code_commit	—
`[be51b1d6bbff48c7d1943a8ff1e5a55777807f6e,530f8f9c3546cb3ebee1b135375aaee08a073ebb)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`6.2`	affected	generic	—
`[0,6.2)`	unaffected	generic	—
`[6.12.109,6.13.0)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the commit fixing this race condition; the patch guarantees that handle->dev is initialized before the IOMMU handle becomes visible.
If a kernel upgrade cannot be performed immediately, restrict IOMMU functionality to a single thread to prevent concurrent races; this mitigates the NULL dereference risk implied by CWE‑476.
Continuously monitor kernel log messages for OOPS, panic or malformed iommu_sva_unbind_device events and apply the kernel hotfix as soon as it becomes available.

Generated by OpenCVE AI on September 21, 2026 at 01:27 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-9091-1	Linux kernel (NVIDIA Tegra) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.206% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/37a96a30617a4c96f048a5874c00509bc4fe4d85
https://git.kernel.org/stable/c/530f8f9c3546cb3ebee1b135375aaee08a073ebb
https://git.kernel.org/stable/c/968e9a1f71140c86dc4092f6b361e997923f3813
https://git.kernel.org/stable/c/bcffb1c75da8fc9d51168ff9f09d471c26507912
https://git.kernel.org/stable/c/c4c71368bc5c5b3840590d39b4cfa12d733cadf4
https://nvd.nist.gov/vuln/detail/CVE-2026-89451
https://www.cve.org/CVERecord?id=CVE-2026-89451

History

Oct 21, 2026 1:00 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/c4c71368bc5c5b3840590d39b4cfa12d733cadf4

Sep 12, 2026 12:15 PM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-476
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89451 https://www.cve.org/CVERecord?id=CVE-2026-89451
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.1, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sep 11, 2026 11:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: iommu/sva: Set handle->dev before the SVA handle is visible iommu_attach_device_pasid() installs the new SVA attach handle in the group PASID lookup before iommu_sva_bind_device() returns. A concurrent bind can therefore find and reuse the same handle after iommu_sva_lock is dropped. handle->dev was initialized after dropping iommu_sva_lock. This leaves a window where a racing bind can return a handle whose dev pointer is still NULL. A subsequent iommu_sva_unbind_device() can then dereference it via handle->dev->iommu_group. Initialize handle->dev before releasing iommu_sva_lock so any visible SVA handle is fully initialized.
Title		iommu/sva: Set handle->dev before the SVA handle is visible
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/37a96a30617a4c96f048a5874c00509bc4fe4d85 https://git.kernel.org/stable/c/530f8f9c3546cb3ebee1b135375aaee08a073ebb https://git.kernel.org/stable/c/968e9a1f71140c86dc4092f6b361e997923f3813 https://git.kernel.org/stable/c/bcffb1c75da8fc9d51168ff9f09d471c26507912