Executive brief
A memory leak exists in the Linux kernel's IOMMU (Input/Output Memory Management Unit) device initialization code. When device setup fails during a specific mock device creation operation, allocated memory is not properly freed, potentially leading to memory exhaustion over time if the failure condition is triggered repeatedly.
Technical details
The vulnerability is a memory leak in iommu_mock_device_add() where iommu_fwspec_init() allocates dev->iommu via dev_iommu_get(), but when a subsequent device_add() call fails, only iommu_fwspec_free() is called in the error path. This frees the fwspec structure but leaves the outer dev->iommu struct allocated, causing unreferenced memory. The fix changes the error path to call dev_iommu_free() instead, which properly frees both fwspec and the dev->iommu struct. The vulnerability requires kernel code execution or the ability to trigger device initialization failures through sysfs or driver interfaces.
Affected products
- Linux Linux kernel versions with IOMMU mock device code
Timeline
- 2026-09-11: disclosed