Executive brief
A vulnerability in the Linux kernel's memory management for hardware devices could cause a system crash. This affects systems using Shared Virtual Addressing (SVA), which allows devices to directly access process memory. An attacker with local access could exploit this to cause a denial of service or potentially gain unauthorized access to sensitive information.
Technical details
A use-after-free vulnerability exists in the iommu_sva_unbind_device() function within drivers/iommu/iommu-sva.c. The root cause is a race condition or improper sequencing where iommu_domain_free() is called, triggering mmdrop() and subsequently freeing the iommu_mm structure. The code then attempts to access domain->mm->iommu_mm after it has been deallocated. A local attacker can trigger this by unbinding a device, leading to a kernel panic (DoS) or potentially arbitrary code execution. The fix involves reordering the operations to ensure all necessary structure accesses occur before the memory is released.
Affected products
- Linux Linux Kernel 6.18.7 to 6.18.20, 6.19.1 to 6.19.10, 7.0-rc1 to 7.0-rc7
Timeline
- 2026-03-04: other: Patch authored
- 2026-03-17: other: Patch committed to stable tree
- 2026-04-03: disclosed: CVE published