In the Linux kernel, the following vulnerability has been resolved:
iommufd: Fix protection fault in iommufd_test_syz_conv_iova
Syzkaller reported the following bug:
general protection fault, probably for non-canonical address 0xdffffc0000000038: 0000 [#1] SMP KASAN KASAN: null-ptr-deref in range [0x00000000000001c0-0x00000000000001c7] Call Trace: lock_acquire lock_acquire+0x1ce/0x4f0 down_read+0x93/0x4a0 iommufd_test_syz_conv_iova+0x56/0x1f0 iommufd_test_access_rw.isra.0+0x2ec/0x390 iommufd_test+0x1058/0x1e30 iommufd_fops_ioctl+0x381/0x510 vfs_ioctl __do_sys_ioctl __se_sys_ioctl __x64_sys_ioctl+0x170/0x1e0 do_syscall_x64 do_syscall_64+0x71/0x140
This is because the new iommufd_access_change_ioas() sets access->ioas to NULL during its process, so the lock might be gone in a concurrent racing context.
Fix this by doing the same access->ioas sanity as iommufd_access_rw() and iommufd_access_pin_pages() functions do.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 27, 2026 | Jul 27, 2026 |
| Redhat_linux | — | Upgrade kernel-rtUpgrade kernelNo solution exists | Dec 5, 2024 | Apr 4, 2024 |
| Suse | — | Upgrade kernel-devel-rtUpgrade kernel-debugUpgrade dtb-allwinnerUpgrade dtb-rockchipUpgrade dtb-exynosUpgrade gfs2-kmp-64kbUpgrade kernel-kvmsmall-develUpgrade ocfs2-kmp-defaultUpgrade dtb-mediatekUpgrade kernel-default-base-rebuildUpgrade kernel-default-optionalUpgrade kernel-rtUpgrade reiserfs-kmp-azureUpgrade kernel-zfcpdumpUpgrade cluster-md-kmp-rtUpgrade kernel-sourceUpgrade dtb-caviumUpgrade dtb-alteraUpgrade kernel-symsUpgrade dtb-qcomUpgrade kernel-rt_debug-livepatch-develUpgrade gfs2-kmp-azureUpgrade ocfs2-kmp-azureUpgrade ocfs2-kmp-rtUpgrade dtb-armUpgrade kernel-64kb-livepatch-develUpgrade kernel-defaultUpgrade dtb-apmUpgrade gfs2-kmp-defaultUpgrade dtb-hisiliconUpgrade kselftests-kmp-64kbUpgrade dtb-xilinxUpgrade kernel-64kb-develUpgrade kernel-syms-azureUpgrade dlm-kmp-64kbUpgrade kernel-64kb-extraUpgrade dtb-renesasUpgrade kernel-default-vdsoUpgrade kernel-rt-develUpgrade reiserfs-kmp-defaultUpgrade kernel-develUpgrade dtb-nvidiaUpgrade kernel-default-livepatch-develUpgrade dtb-amazonUpgrade dlm-kmp-rtUpgrade kernel-rt-optionalUpgrade kernel-source-rtUpgrade dtb-freescaleUpgrade dtb-socionextUpgrade kernel-obs-buildUpgrade kernel-debug-livepatch-develUpgrade kernel-azure-vdsoUpgrade kernel-source-vanillaUpgrade kselftests-kmp-rtUpgrade kernel-kvmsmall-vdsoUpgrade dtb-amlogicUpgrade cluster-md-kmp-64kbUpgrade reiserfs-kmp-64kbUpgrade dtb-marvellUpgrade kernel-rt_debug-develUpgrade kernel-rt-vdsoUpgrade kernel-docs-htmlUpgrade kernel-default-baseUpgrade kernel-azure-develUpgrade kernel-obs-qaUpgrade kernel-azure-livepatch-develUpgrade kernel-source-azureUpgrade kernel-default-extraUpgrade kernel-64kbUpgrade kernel-devel-azureUpgrade dtb-lgUpgrade cluster-md-kmp-azureUpgrade kselftests-kmp-azureUpgrade kselftests-kmp-defaultUpgrade kernel-syms-rtUpgrade kernel-rt-livepatch-develUpgrade kernel-default-develUpgrade kernel-debug-vdsoUpgrade kernel-debug-develUpgrade kernel-azure-extraUpgrade kernel-azureUpgrade kernel-64kb-optionalUpgrade dtb-appleUpgrade dlm-kmp-defaultUpgrade dlm-kmp-azureUpgrade kernel-macrosUpgrade kernel-kvmsmallUpgrade kernel-default-livepatchUpgrade kernel-rt_debugUpgrade kernel-rt-extraUpgrade cluster-md-kmp-defaultUpgrade reiserfs-kmp-rtUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-docsUpgrade dtb-amdUpgrade ocfs2-kmp-64kbUpgrade gfs2-kmp-rtUpgrade dtb-broadcomUpgrade kernel-azure-optionalUpgrade dtb-sprdUpgrade kernel-rt_debug-vdso | Aug 8, 2024 | Apr 4, 2024 |
| Ubuntu | — | Upgrade linux-raspi-realtime | Feb 11, 2025 | Apr 4, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub