CVE-2026-80817

A flaw was found in the Linux kernel's iommu/iommufd component. A local user could exploit a race condition during the processing of I/O address space (IOAS) areas. This vulnerability occurs when iommufd_ioas_change_process attempts to access an IOAS area before its pages are fully mapped, leading to a NULL pointer dereference. The consequence is a kernel crash, resulting in a denial of service for the system.

This vulnerability is rated as a Moderate impact because exploitation requires local access with permissions to interact with I/O address space user endpoints, restricting the blast radius to a denial of service without compromising system confidentiality or integrity. In typical Red Hat environments, this interface is utilized primarily during specialized virtualization workflows involving direct hardware pass-through. Triggering the race condition requires concurrent address space operations on an active file descriptor, resulting in an unhandled kernel panic rather than arbitrary code execution.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.