In the Linux kernel, the following vulnerability has been resolved:
iommufd: Fix protection fault in iommufd_test_syz_conv_iova
Syzkaller reported the following bug:
general protection fault, probably for non-canonical address 0xdffffc0000000038: 0000 [#1] SMP KASAN KASAN: null-ptr-deref in range [0x00000000000001c0-0x00000000000001c7] Call Trace: lock_acquire lock_acquire+0x1ce/0x4f0 down_read+0x93/0x4a0 iommufd_test_syz_conv_iova+0x56/0x1f0 iommufd_test_access_rw.isra.0+0x2ec/0x390 iommufd_test+0x1058/0x1e30 iommufd_fops_ioctl+0x381/0x510 vfs_ioctl __do_sys_ioctl __se_sys_ioctl __x64_sys_ioctl+0x170/0x1e0 do_syscall_x64 do_syscall_64+0x71/0x140
This is because the new iommufd_access_change_ioas() sets access->ioas to NULL during its process, so the lock might be gone in a concurrent racing context.
Fix this by doing the same access->ioas sanity as iommufd_access_rw() and iommufd_access_pin_pages() functions do.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 27, 2026 | Jul 27, 2026 |
| Redhat_linux | — | Upgrade kernel-rtUpgrade kernelNo solution exists | Dec 5, 2024 | Apr 4, 2024 |
| Suse | — | Upgrade kernel-source-azureUpgrade kernel-devel-azureUpgrade kernel-64kbUpgrade cluster-md-kmp-64kbUpgrade dtb-amdUpgrade kernel-source-vanillaUpgrade dtb-amlogicUpgrade dtb-sprdUpgrade ocfs2-kmp-64kbUpgrade dtb-freescaleUpgrade dtb-broadcomUpgrade kernel-rt-livepatch-develUpgrade kernel-rt-optionalUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-rt_debug-vdsoUpgrade kernel-docsUpgrade kernel-azure-optionalUpgrade kernel-source-rtUpgrade gfs2-kmp-rtUpgrade kernel-azure-vdsoUpgrade dtb-amazonUpgrade kselftests-kmp-rtUpgrade dlm-kmp-rtUpgrade kernel-obs-qaUpgrade kernel-rt-vdsoUpgrade kernel-rt_debug-develUpgrade kernel-azure-livepatch-develUpgrade kernel-azure-develUpgrade kernel-default-baseUpgrade kernel-debug-livepatch-develUpgrade kernel-docs-htmlUpgrade dtb-socionextUpgrade kernel-kvmsmall-vdsoUpgrade kernel-default-extraUpgrade kselftests-kmp-azureUpgrade kernel-obs-buildUpgrade dtb-lgUpgrade kernel-default-livepatchUpgrade cluster-md-kmp-defaultUpgrade kernel-rt_debugUpgrade reiserfs-kmp-rtUpgrade kernel-rt-extraUpgrade dtb-marvellUpgrade kernel-default-livepatch-develUpgrade kernel-kvmsmallUpgrade reiserfs-kmp-64kbUpgrade kernel-debug-develUpgrade kernel-debug-vdsoUpgrade kernel-default-develUpgrade dlm-kmp-defaultUpgrade dlm-kmp-azureUpgrade kernel-64kb-optionalUpgrade kernel-macrosUpgrade kernel-azureUpgrade kselftests-kmp-defaultUpgrade kernel-azure-extraUpgrade dtb-appleUpgrade kernel-syms-rtUpgrade cluster-md-kmp-azureUpgrade dtb-xilinxUpgrade reiserfs-kmp-azureUpgrade kernel-default-vdsoUpgrade ocfs2-kmp-rtUpgrade ocfs2-kmp-azureUpgrade kernel-debugUpgrade kernel-64kb-livepatch-develUpgrade kernel-64kb-extraUpgrade ocfs2-kmp-defaultUpgrade kernel-rt_debug-livepatch-develUpgrade gfs2-kmp-64kbUpgrade dtb-mediatekUpgrade kernel-kvmsmall-develUpgrade kernel-devel-rtUpgrade dtb-allwinnerUpgrade kernel-defaultUpgrade gfs2-kmp-azureUpgrade dtb-armUpgrade kernel-sourceUpgrade dtb-qcomUpgrade kernel-default-base-rebuildUpgrade kernel-default-optionalUpgrade dtb-renesasUpgrade dlm-kmp-64kbUpgrade kernel-syms-azureUpgrade dtb-hisiliconUpgrade cluster-md-kmp-rtUpgrade gfs2-kmp-defaultUpgrade kernel-64kb-develUpgrade kernel-rtUpgrade dtb-caviumUpgrade dtb-alteraUpgrade kernel-zfcpdumpUpgrade kernel-symsUpgrade reiserfs-kmp-defaultUpgrade kernel-rt-develUpgrade kselftests-kmp-64kbUpgrade dtb-nvidiaUpgrade dtb-rockchipUpgrade kernel-develUpgrade dtb-exynosUpgrade dtb-apm | Aug 8, 2024 | Apr 4, 2024 |
| Ubuntu | — | Upgrade linux-raspi-realtime | Feb 11, 2025 | Apr 4, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub