CVE-2026-89451

A flaw was found in the Linux kernel's IOMMU (Input/Output Memory Management Unit) SVA (Shared Virtual Addressing) component. A race condition during the attachment of an SVA handle can lead to a situation where a device pointer is not properly initialized. A local attacker could exploit this flaw by triggering concurrent bind operations, potentially causing a null pointer dereference and a system crash, resulting in a Denial of Service (DoS).

A moderate severity flaw was found in the Linux kernel's IOMMU Shared Virtual Addressing (SVA) implementation. iommu_attach_device_pasid() installs a new SVA attach handle in the group PASID lookup before iommu_sva_bind_device() returns, while handle->dev was initialized only after iommu_sva_lock was dropped. A concurrent bind that finds and reuses the handle in this window can obtain a handle whose dev pointer is still NULL; a subsequent iommu_sva_unbind_device() can then dereference it via handle->dev->iommu_group, causing a NULL pointer dereference. A local attacker able to trigger concurrent SVA bind operations could exploit this race condition to crash the kernel, resulting in a denial of service. Affected products include Red Hat Enterprise Linux 9 and 10 kernel streams that contain the vulnerable code, along with OpenShift Container Platform releases shipping affected RHEL 9-based Red Hat Enterprise Linux CoreOS kernels. Earlier Red Hat Enterprise Linux versions and streams, and OpenShift Container Platform releases built on kernels without the vulnerable code, are not affected because the vulnerable code is not present. The fix is currently deferred for the affected streams because the CVSS 3.1 score of 5.5 reflects moderate impact, which does not meet the threshold for prioritizing an immediate erratum; the residual risk is limited to a local denial of service in environments where concurrent SVA bind operations can be triggered.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.