CVE-2026-80894iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace iommufd_hwpt_replace_device() calls: iommufd_auto_response_faults(hwpt, old_handle); passing the *new* hwpt together with the handle of the device's *old* domain. This should be a parameter mismatch: 1. Semantically, iommufd_auto_response_faults(x, handle) scans x->fault's deliver list and response xarray for groups matching "handle". A group is queued under the hwpt that was attached at fault-delivery time. old_handle is fetched *before* the domain switch, so its group lives on old->fault, not on the new hwpt->fault. 2. Historically, the first argument was "old". The routine was introduced by commit b7d8833677ba ("iommufd: Fault-capable hwpt attach/detach/replace") as __fault_domain_replace_dev() in fault.c, correctly calling iommufd_auto_response_faults(old, curr). Commit fb21b1568ada ("iommufd: Make attach_handle generic than fault specific") moved this into iommufd_hwpt_replace_device() in device.c and swapped it to "hwpt". This should be a refactor regression, not an intentional change. Fix this by passing "old" instead.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 4, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 6d11543bf37abdf60b8e6022a62fccfb82a5fe2e before adb87155b67f9759ff010c0a99559f5bffa45dcf; from fb21b1568adaa76af7a8c853f37c60fba8b28661 before 564ac339c0f8bada4e77a57a92bab9d3df635e07; from fb21b1568adaa76af7a8c853f37c60fba8b28661 before 8eb077025279304268bd58657f0af3d388822b21; from fb21b1568adaa76af7a8c853f37c60fba8b28661 before ba5c0f28a26e7d9be1e0997f8920dd638e2782fd; 1e0216b6a58c79b5ee91c78706d5f560e4d1f56f; 4b23c4b991eb90cc7bca42e9f81142feedd4bb56; from 6.12.24 before 6.12.105; from 6.13.12 before 6.14; and 1 more ranges | CNA record |
References
- https://git.kernel.org/stable/c/adb87155b67f9759ff010c0a99559f5bffa45dcf
- https://git.kernel.org/stable/c/564ac339c0f8bada4e77a57a92bab9d3df635e07
- https://git.kernel.org/stable/c/8eb077025279304268bd58657f0af3d388822b21
- https://git.kernel.org/stable/c/ba5c0f28a26e7d9be1e0997f8920dd638e2782fd
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.