Linux CVE-2026-23429

The vulnerability exists in the Linux kernel's IOMMU (Input/Output Memory Management Unit) Shared Virtual Addressing (SVA) subsystem, specifically in the unbind device path. SVA allows devices to access process virtual address spaces directly. The root cause is a use-after-free condition in iommu_sva_unbind_device(): the function accesses domain->mm->iommu_mm after iommu_domain_free() has already freed the memory management structure through the call chain iommu_domain_free() → mmdrop() → __mmdrop() → mm_pasid_drop(). This violates memory safety principles and results in dereferencing freed heap memory. The fix is a simple code reordering that moves access to domain->mm->iommu_mm to occur before the iommu_domain_free() call, ensuring the pointer remains valid.