CVE-2026-80633

CVE-2026-80633 is a locking flaw in the Linux kernel's iommufd subsystem: iopt_release_pages() calls dma_buf_unpin() without first acquiring the DMA-BUF exporter's dma_resv lock, which dma_buf_unpin() explicitly asserts is held. The bug is triggered whenever iommufd_ioas_destroy() or iommufd_ioas_unmap() releases the last reference on a DMA-BUF-backed iopt_pages — for example, a low-privileged local process using iommufd with imported DMA-BUF mappings (such as virtualization or GPU-passthrough workloads) closing or unmapping its I/O address space, producing a kernel WARN. The directly observed impact is a kernel warning in the DMA-BUF unpin path (a denial-of-service-class reliability bug), while the 8.8 CVSS score reflects a worst case of high confidentiality, integrity and availability impact with scope change. Only systems running kernels whose iommufd code predates the fix and that actually exercise the iommufd DMA-BUF unpin path are affected; the fix takes the dma_resv lock around dma_buf_unpin(), keeping dma_buf_detach() outside the locked region because it acquires the lock internally. No public proof-of-concept exists, the flaw is not in CISA KEV, and EPSS estimates only about 0.1% probability of exploitation within 30 days, so no exploitation is currently known.

What to do: Patch with a kernel that includes the fix commit 'iommufd: Take dma_resv lock before dma_buf_unpin() in release path', obtained via the stable kernel tree or your distribution's next kernel update (no fixed version number was provided in the source data). Until patched, prioritize or restrict workloads on hosts that use iommufd with DMA-BUF-backed mappings (e.g., QEMU/KVM with VFIO DMA-BUF or GPU-passthrough setups), since standard desktop and embedded Linux systems not using iommufd DMA-BUF are effectively unaffected. With no public PoC, no KEV entry, and a ~0.1% EPSS score, treat this as routine patching except for virtualization hosts that exercise the affected path.