EUVD-2026-76351
GHSA-52p7-c9pg-r5j6
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
AC:H because UAF exploitation requires winning a specific race condition; all other metrics from input CVSS are appropriate.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
iommufd: Fix UAF in selftest IOPF reporting
IOMMUFD selftest TRIGGER_IOPF borrows an attach handle from group->pasid_array without synchronizing against PASID detach, then a concurrent iommu_report_device_fault() can dereference that borrowed handle's domain pointer after the detach erases the handle and frees the backing struct iommufd_attach_handle. TRIGGER_IOPF then dereferences the freed handle, causing a UAF.
Fix by adding a iopf_rwsem in mock_dev to follow the expected design of a real driver. Hold its read side across the whole iommu_report_device_fault() call, and its write side around every path that attaches, detaches, or replaces a device domain. This can block new reports and drains in-flight reports before an old attach handle or the IOPF fault parameter can be removed. Also take the write side while registering a mock device, since it can invoke the mock driver's default-domain attach callback.
AnalysisAI
Use-after-free in the Linux kernel's iommufd selftest IOPF reporting enables local privilege escalation from low-privileged users to kernel-level code execution. The race condition exists between TRIGGER_IOPF's unsynchronized borrow of a PASID attach handle and a concurrent PASID detach that frees the backing iommufd_attach_handle struct, leaving iommu_report_device_fault() dereferencing freed memory. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three conditions to hold simultaneously: (1) the target kernel must be compiled with CONFIG_IOMMUFD_TEST=y, a development-only Kconfig symbol disabled in all major Linux distribution kernels; (2) the attacker must have local access with at least low-privilege credentials sufficient to open the iommufd selftest device and issue TRIGGER_IOPF ioctls; (3) the attacker must win a race condition between TRIGGER_IOPF's handle-borrow path and a concurrent PASID detach operation, requiring precise timing or repeated attempts. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is meaningfully lower than the CVSS 8.8 headline suggests. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Linux kernel 6.18.50, 7.2.4, or any release incorporating 7.3-rc1 mainline changes, which introduce the iopf_rwsem synchronization fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Linux systems running vulnerable kernel versions with iommufd enabled and begin applying available kernel security patches from your distribution (check Linux security advisories for specific patched versions). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today