Skip to main content

Linux Kernel EUVDEUVD-2026-38820

| CVE-2026-52952 HIGH
Expired Pointer Dereference (CWE-825)
2026-06-24 Linux GHSA-xhhc-r2pj-8hh5
Information Disclosure Linux Red Hat Suse
8.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
vuln.today AI
6.4 MEDIUM

Local-only race (AV:L/AC:H) reachable only with privileged device/VFIO control (PR:H); kernel UAF gives full C/I/A impact within the host, no cross-boundary scope change (S:U).

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
4.7 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.0 HIGH
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 28, 2026 - 08:32 vuln.today
CVSS changed
Jun 28, 2026 - 08:22 NVD
8.8 (HIGH)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:28 cve.org
HIGH 8.8
CVE Published
Jun 24, 2026 - 16:28 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

iommu: Fix WARN_ON in __iommu_group_set_domain_nofail() due to reset

In __iommu_group_set_domain_internal(), concurrent domain attachments are rejected when any device in the group is recovering. This is necessary to fence concurrent attachments to a multi-device group where devices might share the same RID due to PCI DMA alias quirks, but triggers the WARN_ON in __iommu_group_set_domain_nofail().

Other IOMMU_SET_DOMAIN_MUST_SUCCEED callers in detach/teardown paths, such as __iommu_group_set_core_domain and __iommu_release_dma_ownership, should not be rejected, as the domain would be freed anyway in these nofail paths while group->domain is still pointing to it. So pci_dev_reset_iommu_done() could trigger a UAF when re-attaching group->domain.

Honor the IOMMU_SET_DOMAIN_MUST_SUCCEED flag, allowing the callers through the group->recovery_cnt fence, so as to update the group->domain pointer. Instead add a gdev->blocked check in the device iteration loop, to prevent any concurrent per-device detachment.

AnalysisAI

Use-after-free in the Linux kernel's IOMMU subsystem allows a local low-privileged actor with device-management access to corrupt kernel memory by racing a domain re-attach against an in-progress PCI device reset. The flaw lies in __iommu_group_set_domain_internal(), where the group->recovery_cnt fence wrongly rejected mandatory detach/teardown callers (IOMMU_SET_DOMAIN_MUST_SUCCEED), so group->domain could be freed while still referenced, and pci_dev_reset_iommu_done() could then re-attach the dangling pointer. EPSS is low at 0.16% (6th percentile) and there is no public exploit identified at time of analysis, but the high CVSS (8.8) reflects full kernel-memory confidentiality, integrity, and availability impact.

Technical ContextAI

The affected component is the IOMMU core group/domain management layer of the Linux kernel (cpe:2.3:a:linux:linux). IOMMUs map device DMA into address spaces represented by 'domains'; in multi-device PCI groups, devices can share a Requester ID (RID) due to DMA alias quirks, so the kernel serializes domain attachment using a group->recovery_cnt fence to stop concurrent attaches while a device is recovering from reset. The bug is a lifetime/synchronization defect (root cause class CWE-416 Use-After-Free; the input lists CWE as N/A): the fence also blocked nofail detach/teardown paths such as __iommu_group_set_core_domain and __iommu_release_dma_ownership, which frees the domain anyway but leaves group->domain pointing at it, allowing pci_dev_reset_iommu_done() to re-attach freed memory. The fix honors IOMMU_SET_DOMAIN_MUST_SUCCEED through the fence and substitutes a per-device gdev->blocked check in the iteration loop to still block concurrent per-device detachment.

RemediationAI

Vendor-released patch: update to a fixed stable kernel, specifically 7.0.10 or 7.1, which include commits 8fc289e809f3eb7e36cadc4684ab6fad747a5a93 and 5474e6e17a262db45c60575c73f70210f5c7001f (https://git.kernel.org/stable/c/8fc289e809f3eb7e36cadc4684ab6fad747a5a93 and https://git.kernel.org/stable/c/5474e6e17a262db45c60575c73f70210f5c7001f); apply the corresponding distribution kernel update once available. Where immediate patching is not possible, reduce exposure by restricting which users can drive the vulnerable code paths - limit or disable device passthrough/VFIO and PCI hotplug for untrusted or semi-trusted workloads and remove non-admin access to device reset operations, accepting that this disables passthrough-dependent virtualization use cases. Avoid configurations that place untrusted devices into shared multi-device IOMMU groups with DMA-alias quirks, since that is where the racing reset/re-attach is reachable; consult the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-52952) for downstream advisory tracking.

Same weakness CWE-825 – Expired Pointer Dereference

View all
CVE-2025-49794 CRITICAL POC
9.1
CVE-2024-23310 CRITICAL POC
9.8
CVE-2026-58592 HIGH POC
8.9
CVE-2025-49795 HIGH POC
7.5
CVE-2019-15691 HIGH POC
7.2
CVE-2024-23638 MEDIUM POC
6.5
CVE-2026-53006 CRITICAL
9.8
CVE-2026-52924 CRITICAL
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

EUVD-2026-38820 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy