CVE-2026-89445

CVE-2026-89445 is a Use-After-Free (UAF) in the Linux kernel IOMMUFD selftest. The TRIGGER_IOPF selftest borrows an attach handle from group->pasid_array without synchronizing against a concurrent PASID detach. A racing iommu_report_device_fault() call can then dereference the freed struct iom...

CVE-2026-89445 iommufd: Fix UAF in selftest IOPF reporting

In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix UAF in selftest IOPF reporting IOMMUFD selftest TRIGGERIOPF borrows an attach handle from group-pasidarray without synchronizing against PASID detach, then a concurrent iommureportdevicefault can dereference that...

kernel: iommu/vt-d: Use device rbtree in iopf reporting path

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Use device rbtree in iopf reporting path The Linux kernel CVE team has assigned CVE-2024-35843 to this issue. Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024051717-CVE-2024-35843-516e@gregkh/T...

CVE-2024-35843 iommu/vt-d: Use device rbtree in iopf reporting path

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Use device rbtree in iopf reporting path The existing I/O page fault handler currently locates the PCI device by calling pcigetdomainbusandslot. This function searches the list of all PCI devices until the desired...

CVE-2024-35843 iommu/vt-d: Use device rbtree in iopf reporting path

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Use device rbtree in iopf reporting path The existing I/O page fault handler currently locates the PCI device by calling pcigetdomainbusandslot. This function searches the list of all PCI devices until the desired...