Executive brief
The Linux kernel's AMD IOMMU driver fails to release PCI device references after processing I/O page fault requests. This causes a memory leak where each handled fault accumulates unreleased kernel resources, eventually degrading system performance and potentially preventing new I/O operations from being allocated resources.
Technical details
The vulnerability is a reference count leak in the AMD IOMMU PPR (peripheral page request) fault notifier path. The `iommu_call_iopf_notifier()` function calls `pci_get_domain_bus_and_slot()` to look up the requester PCI device, which increments its reference count. However, neither the successful fault reporting path nor the abort error path drops this reference via `pci_dev_put()`, causing the reference to leak on every handled PPR request. This affects the kernel-space IOMMU driver with no user authentication or network access required; the vulnerability is triggered by normal I/O page fault processing. The fix adds `pci_dev_put(pdev)` calls in both code paths to properly release the reference.
Affected products
- Linux Linux kernel 5.5 and later (introduced in commit 978d626b8f1a)
Timeline
- 2026-09-11: disclosed: Published on NVD
- 2026-07-30: patched: Upstream patch merged by Joerg Roedel
- 2026-09-07: patched: Patch backported to stable kernel releases by Greg Kroah-Hartman