CVE-2026-74328

A flaw was found in the Linux kernel's iommufd component. This vulnerability occurs because the system attempts to destroy page content before a direct memory access buffer (dmabuf) is fully detached, while a mutex (a mechanism to prevent simultaneous access to shared resources) might still be in use. This improper synchronization could lead to memory corruption or unexpected system behavior.

iommufd releases pages content in the wrong order for DMABUF backed mappings. The dmabuf invalidation callbacks may still run during detach and may still use fields inside the iopt_pages object, including synchronization state such as pages mutex, after those fields were already destroyed or references were dropped. This creates a lifetime ordering race and a use after destroy or use after free candidate in a local kernel interface. For the CVSS the PR:L is used because a local process with access to iommufd and a DMABUF backed mapping may trigger the detach path, even if many deployments restrict this to virtualization or device assignment services. The issue is not network reachable. Impact is at least local denial of service via kernel crash and in the paranoid case may include confidentiality or integrity impact because stale callback access to released kernel objects is a memory corruption candidate.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.