46 matches found
SUSE CVE-2026-93205
In the Linux kernel, the following vulnerability has been resolved: iommu/arm-smmu-v3: Manage teardown with devm armsmmudeviceremove manually frees the IOPF queue, destroys the vmidmap and disables the device, while the IRQs and queues are devm managed. devm unwinds only after remove returns, so...
UBUNTU-CVE-2026-93205
In the Linux kernel, the following vulnerability has been resolved: iommu/arm-smmu-v3: Manage teardown with devm armsmmudeviceremove manually frees the IOPF queue, destroys the vmidmap and disables the device, while the IRQs and queues are devm managed. devm unwinds only after remove returns, so...
CVE-2026-93205
The Linux kernel contains a vulnerability in the iommu/arm-smmu-v3 component due to an incorrect cleanup order during device removal. Specifically, arm_smmu_device_remove() manually frees the IOPF queue and destroys the vmid_map while IRQs and queues are managed by devm . Because devm unwinds onl...
CVE-2026-93205 iommu/arm-smmu-v3: Manage teardown with devm
In the Linux kernel, the following vulnerability has been resolved: iommu/arm-smmu-v3: Manage teardown with devm armsmmudeviceremove manually frees the IOPF queue, destroys the vmidmap and disables the device, while the IRQs and queues are devm managed. devm unwinds only after remove returns, so...
CVE-2026-93205: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: iommu/arm-smmu-v3: Manage teardown with devm armsmmudeviceremove manually frees the IOPF queue, destroys the vmidmap and disables the device, while the IRQs and queues are devm managed. devm unwinds only after remove returns, so...
PT-2026-97872
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the iommu/arm-smmu-v3 component where the arm smmu device remove function manually frees the IOPF queue, destroys the vmid map, and disables the device. Because the IR...
Linux Distros Unpatched Vulnerability : CVE-2026-89445
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iommufd: Fix UAF in selftest IOPF reporting IOMMUFD selftest TRIGGERIOPF borrows an attach handle from group-pasidarray without synchronizing against PASID...
DEBIAN-CVE-2026-89445
In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix UAF in selftest IOPF reporting IOMMUFD selftest TRIGGERIOPF borrows an attach handle from group-pasidarray without synchronizing against PASID detach, then a concurrent iommureportdevicefault can dereference that...
CVE-2026-89445
In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix UAF in selftest IOPF reporting IOMMUFD selftest TRIGGERIOPF borrows an attach handle from group-pasidarray without synchronizing against PASID detach, then a concurrent iommureportdevicefault can dereference that...
CVE-2026-89445
In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix UAF in selftest IOPF reporting IOMMUFD selftest TRIGGERIOPF borrows an attach handle from group-pasidarray without synchronizing against PASID detach, then a concurrent iommureportdevicefault can dereference that...
UBUNTU-CVE-2026-89445
In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix UAF in selftest IOPF reporting IOMMUFD selftest TRIGGERIOPF borrows an attach handle from group-pasidarray without synchronizing against PASID detach, then a concurrent iommureportdevicefault can dereference that...
CVE-2026-89445 iommufd: Fix UAF in selftest IOPF reporting
In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix UAF in selftest IOPF reporting IOMMUFD selftest TRIGGERIOPF borrows an attach handle from group-pasidarray without synchronizing against PASID detach, then a concurrent iommureportdevicefault can dereference that...
CVE-2026-89445
CVE-2026-89445 is a Use-After-Free in the Linux kernel 's iommufd selftest component. The TRIGGER_IOPF selftest borrows an attach handle from group->pasid_array without synchronizing against PASID detach, allowing a concurrent iommu_report_device_fault() to dereference a freed struct iommufd_a...
CVE-2026-89445 iommufd: Fix UAF in selftest IOPF reporting
In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix UAF in selftest IOPF reporting IOMMUFD selftest TRIGGERIOPF borrows an attach handle from group-pasidarray without synchronizing against PASID detach, then a concurrent iommureportdevicefault can dereference that...
PT-2026-90169
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the iommu/amd component where PCI device references are leaked during the handling of PPR Page Request Interface faults. The iommu call iopf notifier function uses pci...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerabilities have been resolved: iommu/iommufd: Fixed UAF in group ownership handling for IOPF. iopfgroupalloc links each last-page IOPF group to the generic pending list before invoking the domain fault handler. iommufdfaultiopfhandler also queues the accept...
SUSE CVE-2026-74520
In the Linux kernel, the following vulnerability has been resolved: iommu/iommufd: Fix IOPF group ownership UAF iopfgroupalloc links each last-page IOPF group into the generic IOPF pending list before invoking the domain fault handler. iommufdfaultiopfhandler also queued an accepted group in the...
CVE-2026-74520
In the Linux kernel, the following vulnerability has been resolved: iommu/iommufd: Fix IOPF group ownership UAF iopfgroupalloc links each last-page IOPF group into the generic IOPF pending list before invoking the domain fault handler. iommufdfaultiopfhandler also queued an accepted group in the...
CVE-2026-74520
In the Linux kernel, the following vulnerability has been resolved: iommu/iommufd: Fix IOPF group ownership UAF iopfgroupalloc links each last-page IOPF group into the generic IOPF pending list before invoking the domain fault handler. iommufdfaultiopfhandler also queued an accepted group in the...
UBUNTU-CVE-2026-74520
In the Linux kernel, the following vulnerability has been resolved: iommu/iommufd: Fix IOPF group ownership UAF iopfgroupalloc links each last-page IOPF group into the generic IOPF pending list before invoking the domain fault handler. iommufdfaultiopfhandler also queued an accepted group in the...