Executive brief
The Linux kernel's IOMMU Shared Virtual Addressing (SVA) subsystem has a race condition where concurrent device binding operations can obtain an incompletely initialized handle. If one thread accesses the handle before another thread finishes initialization, a null pointer dereference can occur when unbinding the device, causing a kernel crash and potential denial of service.
Technical details
This is a use-after-free / race condition vulnerability in the kernel's IOMMU SVA code (drivers/iommu/iommu-sva.c). The vulnerable component is the iommu_sva_bind_device() function, which installs a new SVA handle in a group's PASID lookup table before fully initializing the handle's dev pointer. A concurrent bind operation can find and return the partially-initialized handle after iommu_sva_lock is released but before handle->dev is set, leaving a window where the pointer is NULL. A subsequent iommu_sva_unbind_device() call dereferences this NULL pointer via handle->dev->iommu_group, causing a kernel crash. The fix reorders initialization to set handle->dev before releasing the lock, ensuring any visible handle is fully initialized. No network or privilege escalation required; the vulnerability affects local kernel stability.
Affected products
- Linux Linux Kernel Multiple versions (IOMMU/SVA subsystem; fixed in mainline and stable branches)
Timeline
- 2026-07-26: other: Vulnerability fixed upstream by Shuai Xue
- 2026-08-10: patched: Fix merged into Joerg Roedel's tree
- 2026-09-07: patched: Fix released in stable kernel by Greg Kroah-Hartman
- 2026-09-11: disclosed: Advisory published