CVE-2026-80687 PUBLISHED

iommufd/viommu: Release the igroup lock on the vdevice_size error path

Assigner: Linux
Reserved: 26.08.2026 Published: 28.08.2026 Updated: 28.08.2026

In the Linux kernel, the following vulnerability has been resolved:

iommufd/viommu: Release the igroup lock on the vdevice_size error path

iommufd_vdevice_alloc_ioctl() takes idev->igroup->lock, then validates the driver's vdevice_size against the core structure size with a WARN_ON_ONCE. On failure that guard jumps to out_put_idev, below out_unlock_igroup, so it skips the mutex_unlock(), leaving the igroup lock held and deadlocking the next vDEVICE operation on that group.

Jump to out_unlock_igroup instead.

Product Status

Vendor Linux
Product Linux
Versions Default: unaffected
  • affected from ed42eee797ff3dc889ade63c1dd7c4f430699e23 to 294b464b2be7e57872864cb6936e1d9c7294f89d (excl.)
  • affected from ed42eee797ff3dc889ade63c1dd7c4f430699e23 to ca9e49e1c8931a4e6e743a1f1d2e7f977f774b86 (excl.)
  • affected from ed42eee797ff3dc889ade63c1dd7c4f430699e23 to 339bd11591593ab7ce88136ab7fd01ef3813b724 (excl.)
Vendor Linux
Product Linux
Versions Default: affected
  • Version 6.17 is affected
  • unaffected from 0 to 6.17 (excl.)
  • unaffected from 6.18.44 to 6.18.* (incl.)
  • unaffected from 7.1.8 to 7.1.* (incl.)
  • unaffected from 7.2 to * (incl.)

References