Executive brief
The Linux kernel's iommufd subsystem contains a bug in virtual device (vDEVICE) allocation that causes a mutex lock to remain held on error conditions. When certain validation checks fail, the code path skips the lock release, causing subsequent operations on the same device group to deadlock and hang indefinitely, disrupting I/O virtualization operations.
Technical details
The vulnerability is a missing mutex unlock in the iommufd_vdevice_alloc_ioctl() function within drivers/iommu/iommufd/viommu.c. The function acquires idev->igroup->lock and then validates the driver's vdevice_size via a WARN_ON_ONCE() check. On validation failure, the error path incorrectly jumps to out_put_idev (which skips the mutex_unlock()) instead of out_unlock_igroup (which properly releases the lock). This leaves the igroup lock held, causing any subsequent vDEVICE operation on that group to deadlock. The fix is a single-line change to jump to the correct error label. The vulnerability was introduced in commit ed42eee797ff3 and affects all Linux kernel versions with that feature enabled.
Affected products
- Linux Linux kernel 5.10 and later (affected by iommufd/viommu subsystem feature)
Timeline
- 2026-08-28: disclosed
- 2026-07-14: patched