Description

In the Linux kernel, the following vulnerability has been resolved: iommu/iommufd: Fix IOPF group ownership UAF iopf_group_alloc() links each last-page IOPF group into the generic IOPF pending list before invoking the domain fault handler. iommufd_fault_iopf_handler() also queued an accepted group in the IOMMUFD deliver list without removing it from the generic pending list. When detach or HWPT replacement drops the device's IOPF reference count to zero, an IOMMU driver may call iopf_queue_remove_device(). That function responds to and frees groups through the generic pending list without removing the same groups from IOMMUFD's deliver list or response xarray. A later read, response, or cleanup can then access the freed group and cause a UAF. Fix this by dequeuing an accepted group from the generic pending list before IOMMUFD queues it for userspace response. Make iopf_group_response() send a response regardless of pending-list membership, so the dequeued group can still be completed by IOMMUFD.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-15T13:17:57.210Z",
  "pubdate": "2026-08-15T13:17:57.210Z",
  "executiveSummary": "A Use-After-Free (UAF) vulnerability exists in the Linux kernel IOMMU subsystem, specifically within the interaction between generic I/O Page Fault (IOPF) handling and the IOMMUFD subsystem.\nThe flaw is classified as a Use-After-Free vulnerability, potentially leading to memory corruption, denial of service, or arbitrary code execution within kernel space.\nThe affected products are Linux kernel systems utilizing the IOMMU and IOMMUFD subsystems for device page fault management.\nThe risk implications are severe, as a local attacker or system entity capable of manipulating device attachments and triggering page faults can exploit the race condition or dangling pointer reference.\nExploitation requires local execution capabilities, specifically the ability to configure devices, trigger hardware page faults, and perform operations such as device detachment or Hardware Page Table (HWPT) replacement.",
  "technicalDetails": "The root cause of the vulnerability stems from improper tracking and lifecycle management of IOPF groups between the generic IOPF pending list and the IOMMUFD deliver list.\nDuring execution, iopf_group_alloc() links each last-page IOPF group into the generic IOPF pending list prior to invoking the domain fault handler. Simultaneously, iommufd_fault_iopf_handler() queues an accepted group into the IOMMUFD deliver list without unlinking it from the generic pending list.\nWhen a device detachment or HWPT replacement operation drops the device's IOPF reference count to zero, an IOMMU driver may invoke iopf_queue_remove_device(). This function iterates over the generic pending list, responding to and freeing groups without awareness that the same groups reside in IOMMUFD's deliver list or response xarray.\nConsequently, subsequent read operations, user-space responses, or cleanup routines attempt to access the previously freed IOPF group memory, resulting in a Use-After-Free condition.\nThe attack flow involves an attacker triggering hardware page faults that are allocated and added to the generic pending list, having those groups accepted and queued by IOMMUFD while remaining on the pending list, and then initiating a device detach or HWPT replacement to force the kernel to free the underlying group memory prematurely.\nSubsequent access via IOMMUFD data structures triggers the UAF condition.\nThe vulnerable components include the functions iopf_group_alloc(), iommufd_fault_iopf_handler(), and iopf_queue_remove_device() within the Linux kernel source tree.\nNo network exposure is strictly required as this is a local kernel vulnerability, and exploitation relies on local device management and fault handling mechanisms."
}