CVE-2026-89445

A flaw was found in the Linux kernel's iommufd selftest component. This Use-After-Free UAF vulnerability occurs when the TRIGGERIOPF function borrows an attach handle without proper synchronization during a PASID detach operation. A concurrent device fault report can then access memory that has...

CVE-2026-89445 iommufd: Fix UAF in selftest IOPF reporting

In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix UAF in selftest IOPF reporting IOMMUFD selftest TRIGGERIOPF borrows an attach handle from group-pasidarray without synchronizing against PASID detach, then a concurrent iommureportdevicefault can dereference that...

EUVD-2026-76351

In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix UAF in selftest IOPF reporting IOMMUFD selftest TRIGGERIOPF borrows an attach handle from group-pasidarray without synchronizing against PASID detach, then a concurrent iommureportdevicefault can dereference that...

PT-2026-90161

In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix UAF in selftest IOPF reporting IOMMUFD selftest TRIGGER IOPF borrows an attach handle from group-pasid array without synchronizing against PASID detach, then a concurrent iommu report device fault can dereference tha...