Executive brief
A flaw in the Linux kernel's DMA-heap subsystem leaks file descriptor references when the ioctl allocation fails after the fd has been installed in the process's file table. An attacker can trigger this leak repeatedly via userspace ioctl calls with specially crafted buffer arguments, exhausting the process's fd resources and potentially causing a denial of service.
Technical details
The vulnerability exists in dma_heap_ioctl() when handling DMA_HEAP_IOCTL_ALLOC requests. After dma_buf_fd() installs a file descriptor via fd_install() into the caller's fd table, a subsequent copy_to_user() call may fail (e.g., due to mprotect-based page protection changes between copy_from_user and copy_to_user). If this copy fails, userspace never receives the fd number, but the fd and underlying dma-buf reference remain visible to other threads and are leaked for the process lifetime. The fix restructures the allocation path so fd_install() becomes the final unfailable step: first allocate the dma_buf, then reserve (but not publish) an fd via get_unused_fd_flags(), then attempt copy_to_user(), and only on success publish the fd via a new dma_buf_fd_install() helper. On failure, put_unused_fd() and dma_buf_put() clean up without leaving any user-visible state. Exploitation requires no special privileges but can be triggered from userspace via ioctl calls with specially crafted arguments.
Affected products
- Linux Linux kernel before fix (CVE-2026-89996)
Timeline
- 2026-09-16: disclosed