{"id":"CVE-2026-89451","state":"PUBLISHED","title":"iommu/sva: Set handle->dev before the SVA handle is visible","description":"In the Linux kernel, the following vulnerability has been resolved:\n\niommu/sva: Set handle->dev before the SVA handle is visible\n\niommu_attach_device_pasid() installs the new SVA attach handle in the\ngroup PASID lookup before iommu_sva_bind_device() returns. A concurrent\nbind can therefore find and reuse the same handle after iommu_sva_lock is\ndropped.\n\nhandle->dev was initialized after dropping iommu_sva_lock. This leaves a\nwindow where a racing bind can return a handle whose dev pointer is still\nNULL. A subsequent iommu_sva_unbind_device() can then dereference it via\nhandle->dev->iommu_group.\n\nInitialize handle->dev before releasing iommu_sva_lock so any visible SVA\nhandle is fully initialized.","publishedAt":"2026-09-11T19:43:16.730Z","updatedAt":"2026-10-21T12:47:29.668Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"be51b1d6bbff48c7d1943a8ff1e5a55777807f6e","status":"affected","lessThan":"c4c71368bc5c5b3840590d39b4cfa12d733cadf4","versionType":"git"},{"version":"be51b1d6bbff48c7d1943a8ff1e5a55777807f6e","status":"affected","lessThan":"bcffb1c75da8fc9d51168ff9f09d471c26507912","versionType":"git"},{"version":"be51b1d6bbff48c7d1943a8ff1e5a55777807f6e","status":"affected","lessThan":"968e9a1f71140c86dc4092f6b361e997923f3813","versionType":"git"},{"version":"be51b1d6bbff48c7d1943a8ff1e5a55777807f6e","status":"affected","lessThan":"37a96a30617a4c96f048a5874c00509bc4fe4d85","versionType":"git"},{"version":"be51b1d6bbff48c7d1943a8ff1e5a55777807f6e","status":"affected","lessThan":"530f8f9c3546cb3ebee1b135375aaee08a073ebb","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/iommu/iommu-sva.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.2","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.2","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.109","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.50","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.4","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/iommu/iommu-sva.c"]}],"references":["https://git.kernel.org/stable/c/c4c71368bc5c5b3840590d39b4cfa12d733cadf4","https://git.kernel.org/stable/c/bcffb1c75da8fc9d51168ff9f09d471c26507912","https://git.kernel.org/stable/c/968e9a1f71140c86dc4092f6b361e997923f3813","https://git.kernel.org/stable/c/37a96a30617a4c96f048a5874c00509bc4fe4d85","https://git.kernel.org/stable/c/530f8f9c3546cb3ebee1b135375aaee08a073ebb"],"weaknesses":[],"ingestedAt":"2026-10-29T20:13:26.108Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/89xxx/CVE-2026-89451.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-89451","state":"PUBLISHED","datePublished":"2026-09-11T19:43:16.730Z","dateUpdated":"2026-10-21T12:47:29.668Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-09-11T19:38:34.706Z"},"containers":{"cna":{"title":"iommu/sva: Set handle->dev before the SVA handle is visible","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\niommu/sva: Set handle->dev before the SVA handle is visible\n\niommu_attach_device_pasid() installs the new SVA attach handle in the\ngroup PASID lookup before iommu_sva_bind_device() returns. A concurrent\nbind can therefore find and reuse the same handle after iommu_sva_lock is\ndropped.\n\nhandle->dev was initialized after dropping iommu_sva_lock. This leaves a\nwindow where a racing bind can return a handle whose dev pointer is still\nNULL. A subsequent iommu_sva_unbind_device() can then dereference it via\nhandle->dev->iommu_group.\n\nInitialize handle->dev before releasing iommu_sva_lock so any visible SVA\nhandle is fully initialized."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"be51b1d6bbff48c7d1943a8ff1e5a55777807f6e","status":"affected","lessThan":"c4c71368bc5c5b3840590d39b4cfa12d733cadf4","versionType":"git"},{"version":"be51b1d6bbff48c7d1943a8ff1e5a55777807f6e","status":"affected","lessThan":"bcffb1c75da8fc9d51168ff9f09d471c26507912","versionType":"git"},{"version":"be51b1d6bbff48c7d1943a8ff1e5a55777807f6e","status":"affected","lessThan":"968e9a1f71140c86dc4092f6b361e997923f3813","versionType":"git"},{"version":"be51b1d6bbff48c7d1943a8ff1e5a55777807f6e","status":"affected","lessThan":"37a96a30617a4c96f048a5874c00509bc4fe4d85","versionType":"git"},{"version":"be51b1d6bbff48c7d1943a8ff1e5a55777807f6e","status":"affected","lessThan":"530f8f9c3546cb3ebee1b135375aaee08a073ebb","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/iommu/iommu-sva.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.2","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.2","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.109","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.50","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.4","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/iommu/iommu-sva.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/c4c71368bc5c5b3840590d39b4cfa12d733cadf4"},{"url":"https://git.kernel.org/stable/c/bcffb1c75da8fc9d51168ff9f09d471c26507912"},{"url":"https://git.kernel.org/stable/c/968e9a1f71140c86dc4092f6b361e997923f3813"},{"url":"https://git.kernel.org/stable/c/37a96a30617a4c96f048a5874c00509bc4fe4d85"},{"url":"https://git.kernel.org/stable/c/530f8f9c3546cb3ebee1b135375aaee08a073ebb"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-21T12:47:29.668Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.6.160"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.12.109"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.18.50"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"7.2.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"7.3"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}