Junglewise Threat Intelligence

CVE-2026-80894: Linux kernel iommufd wrong parameter in fault response handling

CVE-2026-80894 · Severity: info · Published 2026-09-04

Executive brief

The Linux kernel's iommufd subsystem (which manages I/O memory management units for hardware acceleration) contains a logic error in device domain replacement. When switching a device to a new I/O domain, the code incorrectly references the new domain instead of the old one when responding to pending I/O faults, causing fault responses to be delivered to the wrong domain context and potentially dropping fault acknowledgments.

Technical details

This is a parameter-passing logic error in iommufd_hwpt_replace_device() within drivers/iommu/iommufd/device.c. The function calls iommufd_auto_response_faults() with the new hwpt (hardware page table) but should pass the old hwpt. The old_handle value refers to fault groups queued under the old domain's fault delivery list; scanning the new domain's list instead will fail to find and properly respond to these faults. This is a refactoring regression introduced when the function was moved between files and the parameter was inadvertently swapped. The fix involves changing one line to pass the "old" parameter instead of "hwpt" to iommufd_auto_response_faults(). No user interaction or network access is required; the bug manifests during normal domain replacement operations on systems using iommufd.

Affected products

  • Linux Linux kernel Versions with commit fb21b1568ada and later

Timeline

  • 2026-07-10: other: Patch authored
  • 2026-09-04: disclosed: CVE-2026-80894 published
  • 2026-08-09: patched: Fix merged into stable kernel trees

References

Related threats