CVE-2026-89452 - Vulnerability Details

- iommu/msm: Unwind probe state on registration failure

Description

In the Linux kernel, the following vulnerability has been resolved:

iommu/msm: Unwind probe state on registration failure

msm_iommu_probe() adds its devm-managed IOMMU object to
qcom_iommu_devices before adding the IOMMU sysfs device and registering
it with the IOMMU core.

If iommu_device_sysfs_add() fails, probe returns with the object still on
qcom_iommu_devices. The driver core then releases the devm allocation,
leaving a dangling list entry that later list walks may dereference.

If iommu_device_register() fails, the same dangling list entry remains
and the sysfs device is left registered as well.

Unwind the sysfs device and global list entry in reverse setup order on
the corresponding failure paths.

Published: 2026-09-11

Score: 8.4 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel's msm_iommu driver can leave a dangling list entry and a registered sysfs device when probe initialization fails. This flaw is a CWE-825 weakness that may result in a kernel panic or loss of kernel stability, effectively causing denial of service by crashing the system.

Affected Systems

All builds of the Linux kernel that include the msm_iommu driver are affected. No specific kernel version numbers are listed, so any kernel incorporating this driver is potentially vulnerable.

Risk and Exploitability

The CVSS score of 8.4 signifies a high severity vulnerability, while the EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild. The vulnerability is not listed in CISA's KEV catalog. Based on the description, it is inferred that a local attacker could trigger this flaw by forcing a probe failure through a malformed device during kernel boot or by causing sysfs addition or IOMMU registration to fail, leading to a kernel crash. The attack vector is therefore likely local or confined to system boot time, rather than remote exploitation.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`42df43b36163ed7d0ab13992e411093252903273`	affected	< 51e37f9179387b6e3fa64a3d3b4fece1a38b3a02
`42df43b36163ed7d0ab13992e411093252903273`	affected	< f532401be9312ecd166f616bb74a65b0b4c150fa
`42df43b36163ed7d0ab13992e411093252903273`	affected	< 7f7074a886c4a93e3d12076ce60a510a1ebe400c
`42df43b36163ed7d0ab13992e411093252903273`	affected	< 535a200220ca2c83bc8bf54bd2cbe045d6ee70c4

Linux

affected

Version	Status	Constraints
`4.11`	affected	—
`0`	unaffected	< 4.11
`6.12.112`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[42df43b36163ed7d0ab13992e411093252903273,f532401be9312ecd166f616bb74a65b0b4c150fa)`	affected	code_commit	—
`[42df43b36163ed7d0ab13992e411093252903273,7f7074a886c4a93e3d12076ce60a510a1ebe400c)`	affected	code_commit	—
`[42df43b36163ed7d0ab13992e411093252903273,535a200220ca2c83bc8bf54bd2cbe045d6ee70c4)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.11`	affected	semver	—
`[0,4.11)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the kernel patch that unwinds the sysfs device and global list entry on failure; rebuild or upgrade the kernel to a patched version.
If an immediate kernel update cannot be applied, blacklist the msm_iommu module by adding a line to /etc/modprobe.d/blacklist.conf (for example, "blacklist msm_iommu") or removing the module from the initramfs so that the driver never loads and cannot leave dangling entries.
Optionally disable IOMMU support entirely via the kernel boot parameter iommu=off or by compiling the kernel without CONFIG_IOMMU_SUPPORT to further mitigate the risk in environments that still use the driver.

Generated by OpenCVE AI on September 21, 2026 at 01:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00194.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/51e37f9179387b6e3fa64a3d3b4fece1a38b3a02
https://git.kernel.org/stable/c/535a200220ca2c83bc8bf54bd2cbe045d6ee70c4
https://git.kernel.org/stable/c/7f7074a886c4a93e3d12076ce60a510a1ebe400c
https://git.kernel.org/stable/c/f532401be9312ecd166f616bb74a65b0b4c150fa
https://nvd.nist.gov/vuln/detail/CVE-2026-89452
https://www.cve.org/CVERecord?id=CVE-2026-89452

History

Sat, 03 Oct 2026 11:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/51e37f9179387b6e3fa64a3d3b4fece1a38b3a02

Sun, 13 Sep 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 8.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 12 Sep 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89452 https://www.cve.org/CVERecord?id=CVE-2026-89452
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: iommu/msm: Unwind probe state on registration failure msm_iommu_probe() adds its devm-managed IOMMU object to qcom_iommu_devices before adding the IOMMU sysfs device and registering it with the IOMMU core. If iommu_device_sysfs_add() fails, probe returns with the object still on qcom_iommu_devices. The driver core then releases the devm allocation, leaving a dangling list entry that later list walks may dereference. If iommu_device_register() fails, the same dangling list entry remains and the sysfs device is left registered as well. Unwind the sysfs device and global list entry in reverse setup order on the corresponding failure paths.
Title		iommu/msm: Unwind probe state on registration failure
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/535a200220ca2c83bc8bf54bd2cbe045d6ee70c4 https://git.kernel.org/stable/c/7f7074a886c4a93e3d12076ce60a510a1ebe400c https://git.kernel.org/stable/c/f532401be9312ecd166f616bb74a65b0b4c150fa

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:43:17.405Z

Updated: 2026-10-03T10:56:29.062Z

Reserved: 2026-09-11T19:38:34.706Z

Link: CVE-2026-89452

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:25.843

Modified: 2026-10-03T11:17:42.200

Link: CVE-2026-89452

Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:43:17Z

Links: CVE-2026-89452 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-21T01:30:08Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object