CVE-2026-93205

A flaw was found in the Linux kernel's iommu/arm-smmu-v3 component. During device removal, the system incorrectly frees the Input-Output Memory Management Unit (IOMMU) Page Fault (IOPF) queue before its associated interrupt request (IRQ) handler finishes using it. This improper cleanup order leads to a use-after-free vulnerability, which could result in system instability or a denial of service.

Red Hat classifies this vulnerability as Moderate because it is limited to systems operating ARM SMMU v3 hardware and can only occur during device unbind or removal operations. An attacker with local access cannot exploit this in typical steady-state operations, and the blast radius is confined to a denial of service via kernel panic. Non-ARM architectures and systems not undergoing dynamic device reconfigurations are unaffected by this teardown race condition.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.