CVE-2026-89451 iommu/sva: Set handle->dev before the SVA handle is visible

In the Linux kernel, the following vulnerability has been resolved: iommu/sva: Set handle-dev before the SVA handle is visible iommuattachdevicepasid installs the new SVA attach handle in the group PASID lookup before iommusvabinddevice returns. A concurrent bind can therefore find and reuse the...

EUVD-2026-76357

In the Linux kernel, the following vulnerability has been resolved: iommu/sva: Set handle-dev before the SVA handle is visible iommuattachdevicepasid installs the new SVA attach handle in the group PASID lookup before iommusvabinddevice returns. A concurrent bind can therefore find and reuse the...

CVE-2026-89451

CVE-2026-89451 is a race condition in the Linux kernel 's iommu/sva subsystem. iommu_attach_device_pasid() installs the SVA attach handle into the group PASID lookup before iommu_sva_bind_device() returns, allowing a concurrent bind to find and reuse the handle after iommu_sva_lock is dropped. Ho...

EUVD-2026-76356

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Reject a vSID wider than the SIDMATCH field tegra241vintfinitvsid programs the guest-provided vSID into SIDMATCH, whose VIRTSID field spans bits 20:1 with bit 0 as the match-enable flag. The HW therefore...

CVE-2026-89450 iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Reject a vSID wider than the SIDMATCH field tegra241vintfinitvsid programs the guest-provided vSID into SIDMATCH, whose VIRTSID field spans bits 20:1 with bit 0 as the match-enable flag. The HW therefore...

CVE-2026-89449 iommu: Fix dev_iommu memory leak when device_add fails in iommu_mock_device_add

In the Linux kernel, the following vulnerability has been resolved: iommu: Fix deviommu memory leak when deviceadd fails in iommumockdeviceadd iommumockdeviceadd first calls iommufwspecinit, which on success allocates both dev-iommu via deviommuget and dev-iommu-fwspec. If the subsequent...

EUVD-2026-76355

In the Linux kernel, the following vulnerability has been resolved: iommu: Fix deviommu memory leak when deviceadd fails in iommumockdeviceadd iommumockdeviceadd first calls iommufwspecinit, which on success allocates both dev-iommu via deviommuget and dev-iommu-fwspec. If the subsequent...

CVE-2026-89449

CVE-2026-89449 is a memory leak in the Linux kernel IOMMU subsystem, specifically in iommu_mock_device_add() (drivers/iommu/iommu.c). When iommu_fwspec_init() successfully allocates both dev->iommu and dev->iommu->fwspec, but the subsequent device_add() call fails, the error path only ca...

CVE-2026-89449 iommu: Fix dev_iommu memory leak when device_add fails in iommu_mock_device_add

In the Linux kernel, the following vulnerability has been resolved: iommu: Fix deviommu memory leak when deviceadd fails in iommumockdeviceadd iommumockdeviceadd first calls iommufwspecinit, which on success allocates both dev-iommu via deviommuget and dev-iommu-fwspec. If the subsequent...

EUVD-2026-76354

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Force requesting ACS when tboot is enabled Currently the conditions of requesting ACS in detectinteliommu don't include tboot, leading to a possible misconfiguration with ACS disabled e.g. due to user opts while iommu...

CVE-2026-89448 iommu/vt-d: Force requesting ACS when tboot is enabled

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Force requesting ACS when tboot is enabled Currently the conditions of requesting ACS in detectinteliommu don't include tboot, leading to a possible misconfiguration with ACS disabled e.g. due to user opts while iommu...

CVE-2026-89448

CVE-2026-89448 affects the Linux kernel's Intel VT-d IOMMU subsystem. The vulnerability is a misconfiguration risk: the function detect_intel_iommu() did not check for tboot (trusted boot) when deciding whether to request ACS (Access Control Services) . This could result in ACS being disabled (e....

PT-2026-90168

In the Linux kernel, the following vulnerability has been resolved: iommu/msm: Unwind probe state on registration failure msm iommu probe adds its devm-managed IOMMU object to qcom iommu devices before adding the IOMMU sysfs device and registering it with the IOMMU core. If iommu device sysfs add...

PT-2026-90167

In the Linux kernel, the following vulnerability has been resolved: iommu/sva: Set handle-dev before the SVA handle is visible iommu attach device pasid installs the new SVA attach handle in the group PASID lookup before iommu sva bind device returns. A concurrent bind can therefore find and reus...

PT-2026-90307

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: initialize job domain before cleanup paths rocket ioctl submit job releases rjob through rocket job put on allocation error paths. rocket job cleanup unconditionally calls rocket iommu domain putjob-domain, but...

PT-2026-90169

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Put PCI device after handling PPR faults iommu call iopf notifier looks up the requester with pci get domain bus and slot, which returns a PCI device with its reference count incremented. Neither the successful iommu...

PT-2026-90165

In the Linux kernel, the following vulnerability has been resolved: iommu: Fix dev iommu memory leak when device add fails in iommu mock device add iommu mock device add first calls iommu fwspec init, which on success allocates both dev-iommu via dev iommu get and dev-iommu-fwspec. If the...

Linux Distros Unpatched Vulnerability : CVE-2026-80818

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iommu/tegra241-cmdqv: Fix CMDSYNC use-after-free on teardown armsmmuimplremove is registered as a devres action in armsmmuimplprobe, before armsmmuinitqueues...

CVE-2026-80818 iommu/tegra241-cmdqv: Fix CMD_SYNC use-after-free on teardown

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Fix CMDSYNC use-after-free on teardown armsmmuimplremove is registered as a devres action in armsmmuimplprobe, before armsmmuinitqueues allocates smmu-cmdq.q.base. On a devres unwind, whether a failed probe ...

CVE-2026-80818

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Fix CMDSYNC use-after-free on teardown armsmmuimplremove is registered as a devres action in armsmmuimplprobe, before armsmmuinitqueues allocates smmu-cmdq.q.base. On a devres unwind, whether a failed probe ...