CVE-2026-89445

A flaw was found in the Linux kernel's iommufd selftest component. This Use-After-Free (UAF) vulnerability occurs when the TRIGGER_IOPF function borrows an attach handle without proper synchronization during a PASID detach operation. A concurrent device fault report can then access memory that has been freed, leading to system instability, potential information disclosure, or arbitrary code execution.

A race in iommufd selftest IOPF reporting can cause a use-after-free because TRIGGER_IOPF borrows an attach handle from group pasid_array without synchronizing against PASID detach or replace. A local process with access to the iommufd selftest interface can race fault reporting with detach so iommu_report_device_fault or later code dereferences a freed iommufd_attach_handle and its domain pointer. For the CVSS the PR:L is used because the attacker needs local code execution and access to the iommufd selftest control path, but does not necessarily need full administrative privileges if that interface is exposed to the user. The issue is not network reachable and is triggered through local ioctls or selftest operations rather than packet traffic. Impact is at least a local denial of service via kernel crash and in the paranoid case may allow confidentiality or integrity impact due to kernel use-after-free memory corruption. Exposure is limited because the affected code is in the iommufd selftest mock device path, so production risk depends on whether this test interface is built and accessible.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.