CVE-2026-52952

A flaw was found in the Linux kernel's Input/Output Memory Management Unit (IOMMU) subsystem, which manages how devices access system memory. A race condition, a situation where multiple operations occur in an unpredictable order, exists during device recovery when multiple memory domains are being attached concurrently. This can lead to a Use-After-Free (UAF) vulnerability, where the system attempts to use memory that has already been released, potentially allowing a local attacker to execute unauthorized code or cause the system to crash (denial of service).

A flaw rated IMPORTANT by Red Hat Product Security was found in the Linux kernel's IOMMU subsystem. When any device in an IOMMU group is recovering, concurrent domain attachments are rejected; this fence also incorrectly rejects IOMMU_SET_DOMAIN_MUST_SUCCEED callers in detach/teardown paths such as __iommu_group_set_core_domain() and __iommu_release_dma_ownership(). In those nofail paths the domain is freed anyway while group->domain still points to it, so pci_dev_reset_iommu_done() can later re-attach the stale domain pointer, resulting in a use-after-free. A local attacker able to trigger PCI device resets and concurrent IOMMU domain attachment operations could exploit this race condition to crash the system (denial of service) or potentially execute arbitrary code in the kernel. The Red Hat CVSS 3.1 score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) matches the CVEORG severity. The vulnerable code was introduced with the pci_dev_reset_iommu_prepare/done() mechanism and is not present in earlier Red Hat Enterprise Linux releases (RHEL 6, 7, 8, 9, and RHEL 10.0.z/10.2.z streams), so those products are not affected. Red Hat Enterprise Linux 10.3 and Red Hat In-Vehicle OS 2.0/2.1 kernel and kernel-ivos-qualcomm components are affected; fixes are being pursued for these delegated product streams.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.