CVE-2026-23429

Vulnerability

Description

In the Linux kernel's IOMMU subsystem for Shared Virtual Addressing (SVA), a use-after-free bug exists in the iommu_sva_unbind_device() function. The issue arises because domain->mm->iommu_mm can be freed by iommu_domain_free() before it is accessed after that call. This leads to a dereference of a freed mm structure, causing a kernel crash.

Exploitation

An attacker with local access and the ability to trigger device unbinding can exploit this vulnerability. The attack path involves invoking iommu_sva_unbind_device() which calls iommu_domain_free(). After that function returns, the subsequent access to domain->mm->iommu_mm reads freed memory. No special privileges are required beyond being able to unbind an SVA device, which may be available to unprivileged users depending on system configuration.

Impact

Successful exploitation results in a kernel crash (denial of service). Under certain conditions, this use-after-free could potentially be leveraged for privilege escalation, though the primary impact documented is a system crash.

Mitigation

The fix, applied in the Linux kernel stable branches, moves the access to domain->mm->iommu_mm to before the call to iommu_domain_free(), preventing the use-after-free condition [1]. Users should update to a kernel version containing the patch (e.g., commits 58abeb7b9562, 06e14c36e20b, or f5daaa2c959d).