In the Linux kernel, the following vulnerability has been resolved:
iommufd: Fix protection fault in iommufd_test_syz_conv_iova
Syzkaller reported the following bug:
general protection fault, probably for non-canonical address 0xdffffc0000000038: 0000 [#1] SMP KASAN KASAN: null-ptr-deref in range [0x00000000000001c0-0x00000000000001c7] Call Trace: lock_acquire lock_acquire+0x1ce/0x4f0 down_read+0x93/0x4a0 iommufd_test_syz_conv_iova+0x56/0x1f0 iommufd_test_access_rw.isra.0+0x2ec/0x390 iommufd_test+0x1058/0x1e30 iommufd_fops_ioctl+0x381/0x510 vfs_ioctl __do_sys_ioctl __se_sys_ioctl __x64_sys_ioctl+0x170/0x1e0 do_syscall_x64 do_syscall_64+0x71/0x140
This is because the new iommufd_access_change_ioas() sets access->ioas to NULL during its process, so the lock might be gone in a concurrent racing context.
Fix this by doing the same access->ioas sanity as iommufd_access_rw() and iommufd_access_pin_pages() functions do.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 27, 2026 | Jul 27, 2026 |
| Redhat_linux | — | Upgrade kernel-rtNo solution existsUpgrade kernel | Dec 5, 2024 | Apr 4, 2024 |
| Suse | — | Upgrade kernel-debug-vdsoUpgrade kernel-debug-develUpgrade dtb-broadcomUpgrade kernel-macrosUpgrade dlm-kmp-azureUpgrade kernel-kvmsmallUpgrade dlm-kmp-defaultUpgrade dtb-socionextUpgrade kernel-azure-vdsoUpgrade kernel-debug-livepatch-develUpgrade kernel-64kb-optionalUpgrade kernel-devel-azureUpgrade kernel-syms-rtUpgrade kernel-default-extraUpgrade kselftests-kmp-azureUpgrade dtb-lgUpgrade kernel-azure-livepatch-develUpgrade kselftests-kmp-defaultUpgrade kernel-azureUpgrade kernel-rt_debugUpgrade reiserfs-kmp-rtUpgrade dtb-appleUpgrade cluster-md-kmp-defaultUpgrade kernel-kvmsmall-vdsoUpgrade kernel-azure-develUpgrade kernel-obs-qaUpgrade dlm-kmp-rtUpgrade kernel-rt_debug-develUpgrade kselftests-kmp-rtUpgrade kernel-rt-vdsoUpgrade kernel-default-baseUpgrade kernel-obs-buildUpgrade kernel-docs-htmlUpgrade dtb-amazonUpgrade kernel-azure-extraUpgrade kernel-default-develUpgrade kernel-default-livepatchUpgrade gfs2-kmp-rtUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-source-rtUpgrade kernel-azure-optionalUpgrade kernel-docsUpgrade kernel-default-livepatch-develUpgrade kernel-rt-livepatch-develUpgrade dtb-marvellUpgrade kernel-rt-optionalUpgrade kernel-64kbUpgrade ocfs2-kmp-64kbUpgrade reiserfs-kmp-64kbUpgrade kernel-rt_debug-vdsoUpgrade dtb-freescaleUpgrade kernel-source-azureUpgrade dtb-amlogicUpgrade cluster-md-kmp-azureUpgrade dtb-amdUpgrade kernel-rt-extraUpgrade dtb-sprdUpgrade kernel-source-vanillaUpgrade cluster-md-kmp-64kbUpgrade reiserfs-kmp-azureUpgrade ocfs2-kmp-defaultUpgrade dtb-alteraUpgrade kernel-default-vdsoUpgrade kernel-rt-develUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-kvmsmall-develUpgrade gfs2-kmp-64kbUpgrade dtb-mediatekUpgrade dtb-allwinnerUpgrade gfs2-kmp-azureUpgrade kernel-devel-rtUpgrade kernel-defaultUpgrade dtb-exynosUpgrade dtb-apmUpgrade ocfs2-kmp-rtUpgrade kernel-64kb-extraUpgrade dtb-xilinxUpgrade kernel-debugUpgrade kernel-64kb-livepatch-develUpgrade reiserfs-kmp-defaultUpgrade dtb-nvidiaUpgrade dlm-kmp-64kbUpgrade kernel-syms-azureUpgrade dtb-renesasUpgrade dtb-hisiliconUpgrade ocfs2-kmp-azureUpgrade kernel-default-base-rebuildUpgrade dtb-qcomUpgrade dtb-caviumUpgrade cluster-md-kmp-rtUpgrade kernel-rtUpgrade kernel-default-optionalUpgrade kernel-zfcpdumpUpgrade kernel-symsUpgrade kernel-sourceUpgrade kernel-64kb-develUpgrade gfs2-kmp-defaultUpgrade dtb-armUpgrade kselftests-kmp-64kbUpgrade kernel-develUpgrade dtb-rockchip | Aug 8, 2024 | Apr 4, 2024 |
| Ubuntu | — | Upgrade linux-raspi-realtime | Feb 11, 2025 | Apr 4, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub