Executive brief
The Linux kernel's iommufd subsystem, which manages I/O memory management units for direct memory access operations, failed to acquire a required lock before unpinning DMA buffers during cleanup. This missing synchronization causes kernel warnings and can lead to data corruption or system instability when applications release memory-mapped I/O resources.
Technical details
The vulnerability is a lock-ordering bug in the iommufd driver's iopt_release_pages() function. The dma_buf_unpin() function requires the caller to hold the exporter's dma_resv (DMA reservation) lock, enforced via dma_resv_assert_held(). However, iopt_release_pages() was calling dma_buf_unpin() without acquiring this lock, triggering kernel warnings on every iommufd_ioas_destroy() or iommufd_ioas_unmap() operation that releases the last reference to DMABUF-backed iopt_pages. The fix is to wrap dma_buf_unpin() with dma_resv_lock() and dma_resv_unlock() calls, while keeping dma_buf_detach() outside the locked region since it acquires the lock internally. The patch was released upstream and backported to stable kernels.
Affected products
- Linux Linux kernel multiple versions with iommufd subsystem (approximately 5.15+)
Timeline
- 2026-08-28: disclosed
- 2026-06-08: patched: Upstream fix committed
- 2026-07-24: patched: Backported to stable kernels