CVE-2026-89451 iommu/sva: Set handle->dev before the SVA handle is visible

In the Linux kernel, the following vulnerability has been resolved: iommu/sva: Set handle-dev before the SVA handle is visible iommuattachdevicepasid installs the new SVA attach handle in the group PASID lookup before iommusvabinddevice returns. A concurrent bind can therefore find and reuse the...

EUVD-2026-76356

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Reject a vSID wider than the SIDMATCH field tegra241vintfinitvsid programs the guest-provided vSID into SIDMATCH, whose VIRTSID field spans bits 20:1 with bit 0 as the match-enable flag. The HW therefore...

CVE-2026-89450 iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Reject a vSID wider than the SIDMATCH field tegra241vintfinitvsid programs the guest-provided vSID into SIDMATCH, whose VIRTSID field spans bits 20:1 with bit 0 as the match-enable flag. The HW therefore...

CVE-2026-89450 iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Reject a vSID wider than the SIDMATCH field tegra241vintfinitvsid programs the guest-provided vSID into SIDMATCH, whose VIRTSID field spans bits 20:1 with bit 0 as the match-enable flag. The HW therefore...

CVE-2026-89451

In the Linux kernel, the following vulnerability has been resolved: iommu/sva: Set handle-dev before the SVA handle is visible iommuattachdevicepasid installs the new SVA attach handle in the group PASID lookup before iommusvabinddevice returns. A concurrent bind can therefore find and reuse the...

EUVD-2026-76355

In the Linux kernel, the following vulnerability has been resolved: iommu: Fix deviommu memory leak when deviceadd fails in iommumockdeviceadd iommumockdeviceadd first calls iommufwspecinit, which on success allocates both dev-iommu via deviommuget and dev-iommu-fwspec. If the subsequent...

CVE-2026-89449 iommu: Fix dev_iommu memory leak when device_add fails in iommu_mock_device_add

In the Linux kernel, the following vulnerability has been resolved: iommu: Fix deviommu memory leak when deviceadd fails in iommumockdeviceadd iommumockdeviceadd first calls iommufwspecinit, which on success allocates both dev-iommu via deviommuget and dev-iommu-fwspec. If the subsequent...

CVE-2026-89449

CVE-2026-89449 is a memory leak in the Linux kernel IOMMU subsystem, specifically in iommu_mock_device_add() (drivers/iommu/iommu.c). When iommu_fwspec_init() successfully allocates both dev->iommu and dev->iommu->fwspec, but the subsequent device_add() call fails, the error path only ca...

CVE-2026-89449 iommu: Fix dev_iommu memory leak when device_add fails in iommu_mock_device_add

In the Linux kernel, the following vulnerability has been resolved: iommu: Fix deviommu memory leak when deviceadd fails in iommumockdeviceadd iommumockdeviceadd first calls iommufwspecinit, which on success allocates both dev-iommu via deviommuget and dev-iommu-fwspec. If the subsequent...

EUVD-2026-76354

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Force requesting ACS when tboot is enabled Currently the conditions of requesting ACS in detectinteliommu don't include tboot, leading to a possible misconfiguration with ACS disabled e.g. due to user opts while iommu...

CVE-2026-89448 iommu/vt-d: Force requesting ACS when tboot is enabled

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Force requesting ACS when tboot is enabled Currently the conditions of requesting ACS in detectinteliommu don't include tboot, leading to a possible misconfiguration with ACS disabled e.g. due to user opts while iommu...

CVE-2026-89448 iommu/vt-d: Force requesting ACS when tboot is enabled

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Force requesting ACS when tboot is enabled Currently the conditions of requesting ACS in detectinteliommu don't include tboot, leading to a possible misconfiguration with ACS disabled e.g. due to user opts while iommu...

CVE-2026-89448

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Force requesting ACS when tboot is enabled Currently the conditions of requesting ACS in detectinteliommu don't include tboot, leading to a possible misconfiguration with ACS disabled e.g. due to user opts while iommu...

CVE-2026-89448

CVE-2026-89448 is a CRITICAL (CVSS 9.3) vulnerability in the Linux kernel's Intel VT-d IOMMU subsystem. The function detect_intel_iommu() fails to check for tboot when determining whether to request ACS (Access Control Services) . When tboot is enabled, tboot_force_iommu() forces the IOMMU on, bu...

PT-2026-90166

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Reject a vSID wider than the SID MATCH field tegra241 vintf init vsid programs the guest-provided vSID into SID MATCH, whose VIRT SID field spans bits 20:1 with bit 0 as the match-enable flag. The HW therefo...

PT-2026-90167

In the Linux kernel, the following vulnerability has been resolved: iommu/sva: Set handle-dev before the SVA handle is visible iommu attach device pasid installs the new SVA attach handle in the group PASID lookup before iommu sva bind device returns. A concurrent bind can therefore find and reus...

PT-2026-90168

In the Linux kernel, the following vulnerability has been resolved: iommu/msm: Unwind probe state on registration failure msm iommu probe adds its devm-managed IOMMU object to qcom iommu devices before adding the IOMMU sysfs device and registering it with the IOMMU core. If iommu device sysfs add...

PT-2026-90307

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: initialize job domain before cleanup paths rocket ioctl submit job releases rjob through rocket job put on allocation error paths. rocket job cleanup unconditionally calls rocket iommu domain putjob-domain, but...

PT-2026-90164

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Force requesting ACS when tboot is enabled Currently the conditions of requesting ACS in detect intel iommu don't include tboot, leading to a possible misconfiguration with ACS disabled e.g. due to user opts while iom...

PT-2026-90165

In the Linux kernel, the following vulnerability has been resolved: iommu: Fix dev iommu memory leak when device add fails in iommu mock device add iommu mock device add first calls iommu fwspec init, which on success allocates both dev-iommu via dev iommu get and dev-iommu-fwspec. If the...