CVE-2026-89445

A use-after-free (UAF) exists in the Linux kernel's IOMMUFD selftest code, where the TRIGGER_IOPF test path borrows an attach handle from group->pasid_array without synchronizing against a concurrent PASID detach, allowing iommu_report_device_fault() to dereference a handle whose backing struct iommufd_attach_handle has already been freed. It is triggered locally by racing the TRIGGER_IOPF selftest ioctl against a PASID detach on the same mock device, causing the kernel to read and write freed memory. Successful exploitation of this memory corruption could allow a local attacker with low privileges to escalate to kernel-level code execution, with high impact on confidentiality, integrity, and availability (CVSS 3.1: 8.8). Critically, the flaw lives in test-only selftest code gated behind CONFIG_IOMMUFD_TEST, so it primarily affects developer and CI machines running test kernels, not standard distribution production kernels where that option is disabled. No public proof of concept exists, the issue is not in the CISA KEV catalog, and no exploitation has been observed in the wild.

What to do: Update to a kernel containing the fix (which adds iopf_rwsem locking around attach/detach/replace and IOPF reporting in the selftest mock device). Verify that production and internet-facing systems are built without CONFIG_IOMMUFD_TEST enabled, as this debug/test option should never be set outside development environments. On test machines, restrict access to the iommufd selftest device and its ioctls to trusted users, since triggering the race requires local access to the test interface.