Junglewise Threat Intelligence

CVE-2026-89453: Linux kernel AMD IOMMU reference count leak in PPR fault handling

CVE-2026-89453 · Severity: info · Published 2026-09-11

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

The Linux kernel's AMD IOMMU driver fails to release PCI device references after processing I/O page fault requests. This causes a memory leak where each handled fault accumulates unreleased kernel resources, eventually degrading system performance and potentially preventing new I/O operations from being allocated resources.

Technical details

The vulnerability is a reference count leak in the AMD IOMMU PPR (peripheral page request) fault notifier path. The `iommu_call_iopf_notifier()` function calls `pci_get_domain_bus_and_slot()` to look up the requester PCI device, which increments its reference count. However, neither the successful fault reporting path nor the abort error path drops this reference via `pci_dev_put()`, causing the reference to leak on every handled PPR request. This affects the kernel-space IOMMU driver with no user authentication or network access required; the vulnerability is triggered by normal I/O page fault processing. The fix adds `pci_dev_put(pdev)` calls in both code paths to properly release the reference.

Affected products

  • Linux Linux kernel 5.5 and later (introduced in commit 978d626b8f1a)

Timeline

  • 2026-09-11: disclosed: Published on NVD
  • 2026-07-30: patched: Upstream patch merged by Joerg Roedel
  • 2026-09-07: patched: Patch backported to stable kernel releases by Greg Kroah-Hartman

References

Related threats