Executive brief
The Intel VT-d IOMMU driver in the Linux kernel contains a resource leak when replacing device I/O memory management domains. When a device's IOPF (I/O Page Fault) domain is changed, the old domain's reference count is not properly released, preventing cleanup of associated PCI resources. This can cause warnings during device removal and potential resource exhaustion over time.
Technical details
The vulnerability is a reference count leak in the Intel VT-d IOMMU driver's RID (Requester ID) domain attachment code. Specifically, intel_iommu_attach_device() and identity_domain_attach_dev() enable IOPF for a new domain but fail to properly disable it for the old domain before replacing it. The iopf_refcount in the device info structure never drops back to zero, preventing iopf_queue_remove_device() from being called and causing iommu_disable_pci_pri() to trigger a WARN_ON during device release. The fix converts the two RID paths to use iopf_for_domain_replace() (which was already correctly used in PASID paths) instead of iopf_for_domain_set() and iopf_for_domain_remove(). This ensures the reference count is properly managed and prevents transient zero states that could evict devices from the IOPF queue.
Affected products
- Linux Linux kernel affected kernels (fix available in mainline and stable series)
Timeline
- 2026-09-17: disclosed: Published in NVD