Answer in brief
CVE-2026-89445 records a High severity (CVSS 8.8) vulnerability in iommufd: Fix UAF in selftest IOPF reporting. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=ddee19971081b42615d62f4fdada21274708ed4d <cab2895729516799384d48560e6fca105fb3f927 || >=ddee19971081b42615d62f4fdada21274708ed4d <e27e90bde68b2ab92e63ed19caad1ef57188bea0 || >=ddee19971081b42615d62f4fdada21274708ed4d <8c07df7cdfcf52f1ff276c588612aabc6c6b8399 | cab2895729516799384d48560e6fca105fb3f927, e27e90bde68b2ab92e63ed19caad1ef57188bea0, 8c07df7cdfcf52f1ff276c588612aabc6c6b8399 |
| Linux/Linuxgeneric | >=ddee19971081b42615d62f4fdada21274708ed4d <fd2e7ac94d6d813548b021473c3dddc30c8c07d1 || >=ddee19971081b42615d62f4fdada21274708ed4d <cab2895729516799384d48560e6fca105fb3f927 || >=ddee19971081b42615d62f4fdada21274708ed4d <e27e90bde68b2ab92e63ed19caad1ef57188bea0 || >=ddee19971081b42615d62f4fdada21274708ed4d <8c07df7cdfcf52f1ff276c588612aabc6c6b8399 | fd2e7ac94d6d813548b021473c3dddc30c8c07d1, cab2895729516799384d48560e6fca105fb3f927, e27e90bde68b2ab92e63ed19caad1ef57188bea0, 8c07df7cdfcf52f1ff276c588612aabc6c6b8399 |
| Linux/Linuxgeneric | 6.11 | Not reported |
Published upstream
Sep 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 11, 2026
In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix UAF in selftest IOPF reporting IOMMUFD selftest TRIGGER_IOPF borrows an attach handle from group->pasid_array without synchronizing against PASID detach, then a concurrent iommu_report_device_fault() can dereference that borrowed handle's domain pointer after the detach erases the handle and frees the backing struct iommufd_attach_handle. TRIGGER_IOPF then dereferences the freed handle, causing a UAF. Fix by adding a iopf_rwsem in mock_dev to follow the expected design of a real driver. Hold its read side across the whole iommu_report_device_fault() call, and its write side around every path that attaches, detaches, or replaces a device domain. This can block new reports and drains in-flight reports before an old attach handle or the IOPF fault parameter can be removed. Also take the write side while registering a mock device, since it can invoke the mock driver's default-domain attach callback.
Quoted source text, attributed separately from HOL analysis.