CVE-2026-89452

The Linux kernel's Qualcomm msm IOMMU driver fails to unwind state when device probe encounters an error: msm_iommu_probe() puts its devm-managed IOMMU object on the global qcom_iommu_devices list before iommu_device_sysfs_add() and iommu_device_register() complete, and on failure of either call the freed allocation is left on the list (with the sysfs device also left registered in the register-failure case). Later list walks can then dereference the dangling entry, causing kernel memory corruption; the CVSS 3.1 base score is 8.4 with a local attack vector, no privileges or user interaction required, and high impact to confidentiality, integrity, and availability. In practice, triggering it requires the sysfs add or core registration to fail during probing, which typically demands local presence on the machine plus the ability to induce that failure, so real-world exploitability is limited despite the high score. Affected systems are Linux kernels built with the msm IOMMU driver, which supports legacy Qualcomm ARM32 (MSM-family) SoCs found in older Android and embedded devices rather than mainstream server or desktop hardware. No public proof of concept is known, the flaw is not in the CISA KEV catalog, and there is no evidence of exploitation in the wild.

What to do: Apply a kernel update containing the fix once it reaches your distribution and backport it to any supported embedded/Android BSPs that enable CONFIG_MSM_IOMMU on Qualcomm MSM platforms. Audit whether the msm IOMMU driver is actually built into your kernel images; systems without it are unaffected. Because triggering requires a failed sysfs add or IOMMU registration during probe, the practical risk is low and this can be handled through normal patch cycles rather than emergency action, though the underlying memory-corruption impact justifies not leaving it unpatched indefinitely.