Executive brief
The Linux kernel's iommufd subsystem (which manages I/O memory management units for hardware acceleration) contains a logic error in device domain replacement. When switching a device to a new I/O domain, the code incorrectly references the new domain instead of the old one when responding to pending I/O faults, causing fault responses to be delivered to the wrong domain context and potentially dropping fault acknowledgments.
Technical details
This is a parameter-passing logic error in iommufd_hwpt_replace_device() within drivers/iommu/iommufd/device.c. The function calls iommufd_auto_response_faults() with the new hwpt (hardware page table) but should pass the old hwpt. The old_handle value refers to fault groups queued under the old domain's fault delivery list; scanning the new domain's list instead will fail to find and properly respond to these faults. This is a refactoring regression introduced when the function was moved between files and the parameter was inadvertently swapped. The fix involves changing one line to pass the "old" parameter instead of "hwpt" to iommufd_auto_response_faults(). No user interaction or network access is required; the bug manifests during normal domain replacement operations on systems using iommufd.
Affected products
- Linux Linux kernel Versions with commit fb21b1568ada and later
Timeline
- 2026-07-10: other: Patch authored
- 2026-09-04: disclosed: CVE-2026-80894 published
- 2026-08-09: patched: Fix merged into stable kernel trees