Junglewise Threat Intelligence

CVE-2026-89449: Linux kernel IOMMU memory leak in device initialization

CVE-2026-89449 · Severity: info · Published 2026-09-11

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A memory leak exists in the Linux kernel's IOMMU (Input/Output Memory Management Unit) device initialization code. When device setup fails during a specific mock device creation operation, allocated memory is not properly freed, potentially leading to memory exhaustion over time if the failure condition is triggered repeatedly.

Technical details

The vulnerability is a memory leak in iommu_mock_device_add() where iommu_fwspec_init() allocates dev->iommu via dev_iommu_get(), but when a subsequent device_add() call fails, only iommu_fwspec_free() is called in the error path. This frees the fwspec structure but leaves the outer dev->iommu struct allocated, causing unreferenced memory. The fix changes the error path to call dev_iommu_free() instead, which properly frees both fwspec and the dev->iommu struct. The vulnerability requires kernel code execution or the ability to trigger device initialization failures through sysfs or driver interfaces.

Affected products

  • Linux Linux kernel versions with IOMMU mock device code

Timeline

  • 2026-09-11: disclosed

Related threats