In the Linux kernel, the following vulnerability has been resolved:
iommufd: Fix protection fault in iommufd_test_syz_conv_iova
Syzkaller reported the following bug:
general protection fault, probably for non-canonical address 0xdffffc0000000038: 0000 [#1] SMP KASAN KASAN: null-ptr-deref in range [0x00000000000001c0-0x00000000000001c7] Call Trace: lock_acquire lock_acquire+0x1ce/0x4f0 down_read+0x93/0x4a0 iommufd_test_syz_conv_iova+0x56/0x1f0 iommufd_test_access_rw.isra.0+0x2ec/0x390 iommufd_test+0x1058/0x1e30 iommufd_fops_ioctl+0x381/0x510 vfs_ioctl __do_sys_ioctl __se_sys_ioctl __x64_sys_ioctl+0x170/0x1e0 do_syscall_x64 do_syscall_64+0x71/0x140
This is because the new iommufd_access_change_ioas() sets access->ioas to NULL during its process, so the lock might be gone in a concurrent racing context.
Fix this by doing the same access->ioas sanity as iommufd_access_rw() and iommufd_access_pin_pages() functions do.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 27, 2026 | Jul 27, 2026 |
| Redhat_linux | — | Upgrade kernelNo solution existsUpgrade kernel-rt | Dec 5, 2024 | Apr 4, 2024 |
| Suse | — | Upgrade dlm-kmp-64kbUpgrade dtb-hisiliconUpgrade kernel-syms-azureUpgrade dtb-renesasUpgrade kernel-kvmsmall-develUpgrade kernel-defaultUpgrade cluster-md-kmp-rtUpgrade gfs2-kmp-azureUpgrade dtb-caviumUpgrade dtb-xilinxUpgrade ocfs2-kmp-azureUpgrade kernel-devel-rtUpgrade dtb-qcomUpgrade kernel-rtUpgrade reiserfs-kmp-defaultUpgrade dtb-apmUpgrade kernel-64kb-livepatch-develUpgrade dtb-nvidiaUpgrade kernel-rt-develUpgrade kernel-debugUpgrade kernel-default-base-rebuildUpgrade dtb-exynosUpgrade kernel-64kb-extraUpgrade dtb-allwinnerUpgrade kernel-default-vdsoUpgrade kernel-default-optionalUpgrade ocfs2-kmp-defaultUpgrade ocfs2-kmp-rtUpgrade gfs2-kmp-64kbUpgrade kernel-symsUpgrade kernel-zfcpdumpUpgrade kernel-sourceUpgrade dtb-alteraUpgrade kernel-64kb-develUpgrade dtb-armUpgrade kernel-rt_debug-livepatch-develUpgrade reiserfs-kmp-azureUpgrade dtb-mediatekUpgrade dtb-rockchipUpgrade kernel-develUpgrade kselftests-kmp-64kbUpgrade gfs2-kmp-defaultUpgrade kernel-source-azureUpgrade kernel-debug-develUpgrade kernel-default-livepatch-develUpgrade kernel-azure-livepatch-develUpgrade kernel-azure-extraUpgrade dtb-appleUpgrade dlm-kmp-defaultUpgrade reiserfs-kmp-rtUpgrade kernel-rt_debugUpgrade kernel-rt-extraUpgrade cluster-md-kmp-defaultUpgrade dtb-marvellUpgrade reiserfs-kmp-64kbUpgrade gfs2-kmp-rtUpgrade ocfs2-kmp-64kbUpgrade dtb-socionextUpgrade kernel-debug-livepatch-develUpgrade kernel-azure-vdsoUpgrade kernel-macrosUpgrade kernel-default-livepatchUpgrade kernel-default-develUpgrade kernel-azureUpgrade kernel-64kb-optionalUpgrade dlm-kmp-azureUpgrade kernel-obs-buildUpgrade kernel-devel-azureUpgrade kernel-syms-rtUpgrade kernel-64kbUpgrade dtb-lgUpgrade dtb-amazonUpgrade dlm-kmp-rtUpgrade cluster-md-kmp-azureUpgrade kselftests-kmp-azureUpgrade kselftests-kmp-defaultUpgrade kernel-default-extraUpgrade kernel-kvmsmall-vdsoUpgrade kernel-default-baseUpgrade kernel-azure-develUpgrade kselftests-kmp-rtUpgrade kernel-rt_debug-develUpgrade kernel-rt-vdsoUpgrade kernel-obs-qaUpgrade kernel-docs-htmlUpgrade dtb-amlogicUpgrade dtb-amdUpgrade cluster-md-kmp-64kbUpgrade kernel-source-vanillaUpgrade dtb-freescaleUpgrade kernel-debug-vdsoUpgrade kernel-kvmsmallUpgrade dtb-broadcomUpgrade kernel-azure-optionalUpgrade dtb-sprdUpgrade kernel-docsUpgrade kernel-rt_debug-vdsoUpgrade kernel-rt-optionalUpgrade kernel-rt-livepatch-develUpgrade kernel-source-rtUpgrade kernel-kvmsmall-livepatch-devel | Aug 8, 2024 | Apr 4, 2024 |
| Ubuntu | — | Upgrade linux-raspi-realtime | Feb 11, 2025 | Apr 4, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub