CVE-2026-89452

iommu/msm: Unwind probe state on registration failure

Published Sep 11, 2026 CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

iommu/msm: Unwind probe state on registration failure

msm_iommu_probe() adds its devm-managed IOMMU object to
qcom_iommu_devices before adding the IOMMU sysfs device and registering
it with the IOMMU core.

If iommu_device_sysfs_add() fails, probe returns with the object still on
qcom_iommu_devices. The driver core then releases the devm allocation,
leaving a dangling list entry that later list walks may dereference.

If iommu_device_register() fails, the same dangling list entry remains
and the sysfs device is left registered as well.

Unwind the sysfs device and global list entry in reverse setup order on
the corresponding failure paths.

Analysis

Technical impact

The Linux kernel's msm_iommu driver can leave a dangling list entry and a registered sysfs device when probe initialization fails. This flaw is a CWE-825 weakness that may result in a kernel panic or loss of kernel stability, effectively causing denial of service by crashing the system.

Affected Systems

All builds of the Linux kernel that include the msm_iommu driver are affected. No specific kernel version numbers are listed, so any kernel incorporating this driver is potentially vulnerable.

Risk and Exploitability

The CVSS score of 8.4 signifies a high severity vulnerability, while the EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild. The vulnerability is not listed in CISA's KEV catalog. Based on the description, it is inferred that a local attacker could trigger this flaw by forcing a probe failure through a malformed device during kernel boot or by causing sysfs addition or IOMMU registration to fail, leading to a kernel crash. The attack vector is therefore likely local or confined to system boot time, rather than remote exploitation.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`42df43b36163ed7d0ab13992e411093252903273`	affected	< 51424c14dbdadc8c2ad4abf842265a50f69d78aa
`42df43b36163ed7d0ab13992e411093252903273`	affected	< 6a1ae472113762f794682229a0f233f1ee0f69a4
`42df43b36163ed7d0ab13992e411093252903273`	affected	< 51e37f9179387b6e3fa64a3d3b4fece1a38b3a02
`42df43b36163ed7d0ab13992e411093252903273`	affected	< f532401be9312ecd166f616bb74a65b0b4c150fa
`42df43b36163ed7d0ab13992e411093252903273`	affected	< 7f7074a886c4a93e3d12076ce60a510a1ebe400c
`42df43b36163ed7d0ab13992e411093252903273`	affected	< 535a200220ca2c83bc8bf54bd2cbe045d6ee70c4

Linux

affected

Version	Status	Constraints
`4.11`	affected	—
`0`	unaffected	< 4.11
`6.1.191`	unaffected	≤ 6.1.*
`6.6.160`	unaffected	≤ 6.6.*
`6.12.112`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[42df43b36163ed7d0ab13992e411093252903273,f532401be9312ecd166f616bb74a65b0b4c150fa)`	affected	code_commit	—
`[42df43b36163ed7d0ab13992e411093252903273,7f7074a886c4a93e3d12076ce60a510a1ebe400c)`	affected	code_commit	—
`[42df43b36163ed7d0ab13992e411093252903273,535a200220ca2c83bc8bf54bd2cbe045d6ee70c4)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`4.11`	affected	semver	—
`[0,4.11)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the kernel patch that unwinds the sysfs device and global list entry on failure; rebuild or upgrade the kernel to a patched version.
If an immediate kernel update cannot be applied, blacklist the msm_iommu module by adding a line to /etc/modprobe.d/blacklist.conf (for example, "blacklist msm_iommu") or removing the module from the initramfs so that the driver never loads and cannot leave dangling entries.
Optionally disable IOMMU support entirely via the kernel boot parameter iommu=off or by compiling the kernel without CONFIG_IOMMU_SUPPORT to further mitigate the risk in environments that still use the driver.

Generated by OpenCVE AI on September 21, 2026 at 01:26 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4850-1	linux-6.12 security update
Debian DSA	DSA-6568-1	linux security update
Ubuntu USN	USN-9002-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.186% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/51424c14dbdadc8c2ad4abf842265a50f69d78aa
https://git.kernel.org/stable/c/51e37f9179387b6e3fa64a3d3b4fece1a38b3a02
https://git.kernel.org/stable/c/535a200220ca2c83bc8bf54bd2cbe045d6ee70c4
https://git.kernel.org/stable/c/6a1ae472113762f794682229a0f233f1ee0f69a4
https://git.kernel.org/stable/c/7f7074a886c4a93e3d12076ce60a510a1ebe400c
https://git.kernel.org/stable/c/f532401be9312ecd166f616bb74a65b0b4c150fa
https://nvd.nist.gov/vuln/detail/CVE-2026-89452
https://www.cve.org/CVERecord?id=CVE-2026-89452

History

Oct 30, 2026 12:45 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/51424c14dbdadc8c2ad4abf842265a50f69d78aa

Oct 21, 2026 1:00 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/6a1ae472113762f794682229a0f233f1ee0f69a4

Oct 3, 2026 11:15 AM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/51e37f9179387b6e3fa64a3d3b4fece1a38b3a02

Sep 13, 2026 6:45 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 8.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sep 12, 2026 12:15 PM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89452 https://www.cve.org/CVERecord?id=CVE-2026-89452
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sep 11, 2026 11:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: iommu/msm: Unwind probe state on registration failure msm_iommu_probe() adds its devm-managed IOMMU object to qcom_iommu_devices before adding the IOMMU sysfs device and registering it with the IOMMU core. If iommu_device_sysfs_add() fails, probe returns with the object still on qcom_iommu_devices. The driver core then releases the devm allocation, leaving a dangling list entry that later list walks may dereference. If iommu_device_register() fails, the same dangling list entry remains and the sysfs device is left registered as well. Unwind the sysfs device and global list entry in reverse setup order on the corresponding failure paths.
Title		iommu/msm: Unwind probe state on registration failure
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/535a200220ca2c83bc8bf54bd2cbe045d6ee70c4 https://git.kernel.org/stable/c/7f7074a886c4a93e3d12076ce60a510a1ebe400c https://git.kernel.org/stable/c/f532401be9312ecd166f616bb74a65b0b4c150fa