CVE-2026-89453

iommu/amd: Put PCI device after handling PPR faults

Published Sep 11, 2026 CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

iommu/amd: Put PCI device after handling PPR faults

iommu_call_iopf_notifier() looks up the requester with
pci_get_domain_bus_and_slot(), which returns a PCI device with its
reference count incremented.

Neither the successful iommu_report_device_fault() path nor the abort
path drops that reference, so every handled PPR request leaks a PCI
device reference.

This is the same ownership rule that was fixed for the old iommu_v2
ppr_notifier() path by commit 6cf0981c2233 ("iommu/amd: Fix pci device
refcount leak in ppr_notifier()"), but iommu_call_iopf_notifier() was
added later as a separate PPR/IOPF notifier path.

Drop the PCI device reference after handling the PPR entry.

Analysis

Technical impact

A missing decremented PCI device reference that is never released. The accumulation of unreleased references to PCI devices can exhaust kernel memory and trigger system instability or denial of service. The vulnerability aligns with CWE‑911, Improper Management of Resource Reference Count.

Affected Systems

The flaw resides in the Linux kernel that enables the iommu_call_iopf_notifier path, typically compiled for AMD hardware with IOMMU support, and is vulnerable. All Linux kernel versions prior to the commit that added the missing drop are affected; version ranges are not explicitly listed.

Risk and Exploitability

The CVSS score is 4.4 and the EPSS score is below 1 %, indicating a low likelihood of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation likely requires repeated PPR faults; based on the description, it is inferred that such faults may be limited to privileged or hardware‑specific code. The reference‑count leak can gradually drain kernel resources, leading to rare but potentially disruptive failures.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`978d626b8f1a239acc635323d731c77eae54eb61`	affected	< 1de4443f85e4405af00153cdf8ba73ff12a65036
`978d626b8f1a239acc635323d731c77eae54eb61`	affected	< cfc5c1b2caa176dfd40b873a6ff07b11da34cc3e
`978d626b8f1a239acc635323d731c77eae54eb61`	affected	< d1470e16c1977e6c94fadf6048deafaa4d150fec
`978d626b8f1a239acc635323d731c77eae54eb61`	affected	< af3b69b16383fbc8fe5f61b5b0150d2e41ede71f

Linux

affected

Version	Status	Constraints
`6.10`	affected	—
`0`	unaffected	< 6.10
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[978d626b8f1a239acc635323d731c77eae54eb61,1de4443f85e4405af00153cdf8ba73ff12a65036)`	affected	code_commit	—
`[978d626b8f1a239acc635323d731c77eae54eb61,cfc5c1b2caa176dfd40b873a6ff07b11da34cc3e)`	affected	code_commit	—
`[978d626b8f1a239acc635323d731c77eae54eb61,d1470e16c1977e6c94fadf6048deafaa4d150fec)`	affected	code_commit	—
`[978d626b8f1a239acc635323d731c77eae54eb61,af3b69b16383fbc8fe5f61b5b0150d2e41ede71f)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`6.10`	affected	generic	—
`[0,6.10)`	unaffected	generic	—
`[6.12.109,6.13.0)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the fix for the PCI device reference‑count leak in the iommu_call_iopf_notifier path.
If a kernel upgrade cannot be performed immediately, disable AMD IOMMU boot using parameters such as iommu=off or iommu=soft to bypass the faulty code path.
Monitor kernel logs (e.g., dmesg, /var/log/kern.log) for repeated PPR fault entries and check PCI device counts to detect possible leakage.

Generated by OpenCVE AI on September 21, 2026 at 01:26 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.206% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1de4443f85e4405af00153cdf8ba73ff12a65036
https://git.kernel.org/stable/c/af3b69b16383fbc8fe5f61b5b0150d2e41ede71f
https://git.kernel.org/stable/c/cfc5c1b2caa176dfd40b873a6ff07b11da34cc3e
https://git.kernel.org/stable/c/d1470e16c1977e6c94fadf6048deafaa4d150fec
https://nvd.nist.gov/vuln/detail/CVE-2026-89453
https://www.cve.org/CVERecord?id=CVE-2026-89453

History

Sep 12, 2026 12:15 PM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-911
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89453 https://www.cve.org/CVERecord?id=CVE-2026-89453
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sep 11, 2026 11:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Put PCI device after handling PPR faults iommu_call_iopf_notifier() looks up the requester with pci_get_domain_bus_and_slot(), which returns a PCI device with its reference count incremented. Neither the successful iommu_report_device_fault() path nor the abort path drops that reference, so every handled PPR request leaks a PCI device reference. This is the same ownership rule that was fixed for the old iommu_v2 ppr_notifier() path by commit 6cf0981c2233 ("iommu/amd: Fix pci device refcount leak in ppr_notifier()"), but iommu_call_iopf_notifier() was added later as a separate PPR/IOPF notifier path. Drop the PCI device reference after handling the PPR entry.
Title		iommu/amd: Put PCI device after handling PPR faults
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1de4443f85e4405af00153cdf8ba73ff12a65036 https://git.kernel.org/stable/c/af3b69b16383fbc8fe5f61b5b0150d2e41ede71f https://git.kernel.org/stable/c/cfc5c1b2caa176dfd40b873a6ff07b11da34cc3e https://git.kernel.org/stable/c/d1470e16c1977e6c94fadf6048deafaa4d150fec