CVE-2026-89447

A flaw was found in the Linux kernel's iommufd subsystem. A local attacker could exploit a vulnerability where an object reference is leaked during the unmapping of internal accesses. This occurs because the iommufd_access_notify_unmap() function incorrectly locks an object before checking if the access is internal, leading to the object reference not being released. This resource leak could potentially lead to a denial of service.

A low security impact flaw was found in the Linux kernel's iommufd subsystem. When notifying unmap events, iommufd_access_notify_unmap() calls iommufd_lock_obj() before checking whether an access is internal; internal accesses are skipped without the matching iommufd_put_object() used by the normal unmap path, so the object reference taken by iommufd_lock_obj() is leaked. A local attacker able to perform iommufd unmap operations could repeatedly trigger this path to leak kernel object references, potentially exhausting kernel resources and causing a denial of service (Red Hat CVSS 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Confidentiality and integrity are not affected. The affected products are Red Hat Enterprise Linux 9.8.z, 9.9, and 9.10 (kernel and kernel-rt), Red Hat Enterprise Linux 10.2.z, 10.3, and 10.4, Red Hat In-Vehicle OS 2.0 and 2.1, and OpenShift Container Platform 4.22, 4.23, 5.0, and 5.1 (RHEL CoreOS 9), whose kernels contain the vulnerable code. Red Hat Enterprise Linux 6, 7, and 8, the 9.2 through 9.6 and 10.0 releases, and OpenShift Container Platform 4.12 through 4.21 are not affected because the vulnerable code is not present in those kernels. Fixes for the affected products are deferred because the CVSS score is below 7.0 and fixes are not scheduled for flaws at this severity. The residual risk is a local denial of service through kernel resource exhaustion by an attacker who already has local access and sufficient privileges to use the iommufd interface.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.