Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-89446

iommufd: Release current IOAS on xa_store() failure

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: iommufd: Release current IOAS on xa_store() failure iommufd_take_all_iova_rwsem() takes an object reference and the iova_rwsem write lock before storing the IOAS in the temporary ioas_list xarray. If xa_store() fails, the current IOAS has not been inserted into ioas_list yet. iommufd_release_all_iova_rwsem() only unwinds IOAS objects already present in that xarray, so it cannot release the current IOAS. Release the current IOAS rwsem and object reference before unwinding the previously stored entries.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 051ae5aa73d782a8be2699a11e17c68f28b4e758 to < 4c33d00ad9a911e87ea222986f732ce072e3aa26affected
  • 051ae5aa73d782a8be2699a11e17c68f28b4e758 to < 07b4fe1367f076886c1c47a19c70936138325087affected
  • 051ae5aa73d782a8be2699a11e17c68f28b4e758 to < 4ac2ce123824d5f885c868fa1f9f4d463141a2baaffected

Linux Linux

Default version status: affected

  • 6.13affected
  • 0 to < 6.13unaffected
  • 6.18.50 to ≤ 6.18.*unaffected
  • 7.2.4 to ≤ 7.2.*unaffected
  • 7.3 to ≤ *unaffected

References