CVE-2026-80687

A flaw was found in the Linux kernel's iommufd/viommu component. An error in the iommufd_vdevice_alloc_ioctl() function's error handling path can lead to a lock being held indefinitely. This can cause a deadlock, preventing further virtual device (vDEVICE) operations and resulting in a Denial of Service (DoS).

A low impact flaw was found in the Linux kernel's iommufd/viommu subsystem. In iommufd_vdevice_alloc_ioctl(), the error path taken when a driver's vdevice_size fails validation against the core structure size jumps past the igroup mutex_unlock(), leaving the IOMMU group lock held indefinitely. A local user with access to the IOMMUFD interface can trigger this error path by issuing a vDEVICE allocation ioctl when the underlying driver configuration fails the vdevice_size check, which deadlocks subsequent vDEVICE operations on that iommu group. The result is a local denial of service limited to vDEVICE operations on the affected group, with no impact on confidentiality or integrity and no privilege escalation. The vulnerable code, introduced with driver-defined vDEVICE support, is present in Red Hat Enterprise Linux 9 (rhel-9.8.z, rhel-9.9, rhel-9.10) and Red Hat Enterprise Linux 10 (rhel-10.2.z, rhel-10.3, rhel-10.4) in the kernel and kernel-rt packages, and in Red Hat In-Vehicle OS 2 in the kernel and kernel-ivos-qualcomm packages. Red Hat Enterprise Linux 6, 7, and 8, the RHEL 9.2, 9.4, and 9.6 update streams, and RHEL 10.0 are not affected because the vulnerable code is not present. The fix is currently deferred for the affected streams because of the low security impact of this flaw; the residual risk is limited to a local denial of service of vDEVICE operations on a single iommu group. Red Hat assesses the impact of this flaw as low, lower than the Moderate severity suggested by the CVSS 3.1 score of 5.5, because exploitation requires local access with the ability to issue IOMMUFD vDEVICE allocation ioctls and the consequence is restricted to the availability of vDEVICE operations on one group.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.