Executive brief
The Linux kernel's iommufd (IOMMU file descriptor) subsystem contains a reference-counting bug in the unmap notification path. A locked object reference is not properly released when processing internal access entries, causing memory to not be freed and potentially leading to resource exhaustion or system instability over time.
Technical details
The vulnerability is a resource leak in the iommufd_access_notify_unmap() function in drivers/iommu/iommufd/device.c. The code locks an access object via iommufd_lock_obj() before checking whether the access is internal; if internal, the loop continues without calling the matching iommufd_put_object() to release the lock, leaking the reference. The fix reorders the condition to check iommufd_access_is_internal() first, preventing internal accesses from ever being locked. No external attack vector exists; the bug manifests as a kernel resource leak affecting system stability. A patch was committed upstream in July 2026 and backported to stable branches.
Affected products
- Linux Linux kernel affected versions include Linux 5.10 and later kernels with iommufd subsystem support
Timeline
- 2026-09-11: disclosed: CVE-2026-89447 published on NVD
- 2026-08-10: patched: Patch committed upstream by Joerg Roedel
- 2026-09-07: patched: Backported to stable branches by Greg Kroah-Hartman