EUVD-2026-59475
GHSA-32j6-f9xj-w83j
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Race condition requiring precise concurrent callback timing during detach warrants AC:H over AC:L; all other metrics retained from vendor vector given consistent local, low-privilege, scope-changing profile.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
iommufd: Destroy the pages content after detaching from dmabuf
Sashiko points out this has gotten out of order, the mutex could still be in use through the dmabuf invalidation callbacks. Don't destroy any of the pages content until the dmabuf is fully detached.
AnalysisAI
Use-after-free in the Linux kernel iommufd subsystem allows a local low-privileged attacker on IOMMU-enabled systems to corrupt kernel memory by triggering dmabuf invalidation callbacks against already-destroyed page structures during detach. Affected configurations include virtualization hosts using VFIO or vDPA device passthrough where the iommufd framework is active. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local code execution with at least low privilege (confirmed by CVSS PR:L) on a Linux host where the iommufd framework is active - specifically, a system with IOMMU enabled in firmware (Intel VT-d or AMD-Vi) and at least one device configured for passthrough via VFIO, vDPA, or a similar dmabuf-sharing mechanism. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 with Changed Scope signals that successful exploitation may breach IOMMU isolation boundaries and affect co-resident workloads or VMs - a serious concern for cloud and virtualization providers. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A low-privileged local attacker on a KVM virtualization host with GPU or NIC passthrough configured initiates a carefully timed sequence of concurrent dmabuf operations - triggering an invalidation callback to fire precisely while the iommufd subsystem is mid-teardown, after the pages mutex has been freed but before the dmabuf detach completes. The resulting use-after-free corrupts kernel memory in a manner that may enable privilege escalation within the host kernel or leak memory contents from co-resident VMs sharing IOMMU domains. … |
| Remediation | The primary fix is to apply the upstream kernel stable patches available at https://git.kernel.org/stable/c/0507fcedbdcc87281ef8639c045fc9980363bbb6 and https://git.kernel.org/stable/c/f2d70dbd3dcefa8e3c380beff9c31f5f033a4221, which reorder the iommufd teardown to ensure dmabuf is fully detached before pages content is destroyed. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify virtualization hosts using VFIO or vDPA device passthrough-these are the only affected systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today