CVE-2026-80894

A flaw was found in the Linux kernel's iommufd component. During the replacement of a device's I/O Memory Management Unit (IOMMU) domain, a parameter mismatch occurs where the iommufd_hwpt_replace_device() function incorrectly uses a new hardware page table (hwpt) with the handle of the old domain. This error can lead to the system scanning an incorrect fault list, potentially causing improper handling of IOMMU faults and affecting system stability.

IOMMUFD device replacement can pass the new hwpt to iommufd_auto_response_faults together with old_handle from the old domain. Fault groups delivered before the replace are stored under the old hwpt fault state, so scanning the new hwpt can leave old fault groups unresolved while old_handle is later freed. This can cause at least a local denial of service in fault handling for an assigned device. In the worst still defensible interpretation, stale fault groups may retain or later compare a freed handle, making this a UAF candidate with possible confidentiality or integrity impact. For the CVSS the PR:L is used because reliable triggering requires local access to IOMMUFD device assignment or a delegated device control context, but not necessarily full host root. The issue is not network reachable and depends on fault capable IOMMUFD usage and device replace operations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.