Executive brief
The Linux kernel's iommufd (IOMMU file descriptor) subsystem manages memory page mappings for device I/O. A timing defect causes page resources to be destroyed before a DMA buffer (dmabuf) is fully detached, leaving invalidation callbacks operating on freed memory. An attacker with unprivileged access to iommufd could trigger a use-after-free condition, potentially gaining kernel code execution.
Technical details
The vulnerability is a use-after-free flaw in the iopt_release_pages() function within drivers/iommu/iommufd/pages.c. The root cause is that the mutex and other page content (mmdrop, put_task_struct, free_uid) were being destroyed before the dmabuf attachment was fully released. During dmabuf detachment, invalidation callbacks may still reference the mutex, resulting in a use-after-free condition. The fix reorders the cleanup sequence to ensure page content is only destroyed after the dmabuf is completely detached. No patch bypass techniques are known. Kernel versions prior to the fix (originating from commit 71db84a092c3) are affected; patches are available in Linux kernel stable trees.
Affected products
- Linux Linux kernel 5.0 through 6.x (before fix in commit f2d70dbd3dcefa8e3c380beff9c31f5f033a4221)
Timeline
- 2026-08-15: disclosed: CVE-2026-74328 published
- 2026-06-08: patched: Fix committed by Jason Gunthorpe (commit f2d70dbd3dcefa8e3c380beff9c31f5f033a4221)
- 2026-07-24: other: Patch backported to stable kernels (commit 0507fcedbdcc87281ef8639c045fc9980363bbb6)