In the Linux kernel, the following vulnerability has been resolved:
iommufd: Fix protection fault in iommufd_test_syz_conv_iova
Syzkaller reported the following bug:
general protection fault, probably for non-canonical address 0xdffffc0000000038: 0000 [#1] SMP KASAN KASAN: null-ptr-deref in range [0x00000000000001c0-0x00000000000001c7] Call Trace: lock_acquire lock_acquire+0x1ce/0x4f0 down_read+0x93/0x4a0 iommufd_test_syz_conv_iova+0x56/0x1f0 iommufd_test_access_rw.isra.0+0x2ec/0x390 iommufd_test+0x1058/0x1e30 iommufd_fops_ioctl+0x381/0x510 vfs_ioctl __do_sys_ioctl __se_sys_ioctl __x64_sys_ioctl+0x170/0x1e0 do_syscall_x64 do_syscall_64+0x71/0x140
This is because the new iommufd_access_change_ioas() sets access->ioas to NULL during its process, so the lock might be gone in a concurrent racing context.
Fix this by doing the same access->ioas sanity as iommufd_access_rw() and iommufd_access_pin_pages() functions do.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 27, 2026 | Jul 27, 2026 |
| Redhat_linux | — | Upgrade kernelNo solution existsUpgrade kernel-rt | Dec 5, 2024 | Apr 4, 2024 |
| Suse | — | Upgrade kernel-azure-livepatch-develUpgrade kernel-devel-azureUpgrade dtb-amazonUpgrade kernel-64kbUpgrade kernel-default-extraUpgrade kernel-source-azureUpgrade kernel-syms-rtUpgrade dtb-lgUpgrade dtb-sprdUpgrade kernel-rt-optionalUpgrade dtb-marvellUpgrade dtb-socionextUpgrade reiserfs-kmp-64kbUpgrade kernel-azure-vdsoUpgrade dtb-appleUpgrade reiserfs-kmp-rtUpgrade kernel-default-livepatch-develUpgrade kernel-debug-livepatch-develUpgrade kernel-azure-extraUpgrade kernel-debug-develUpgrade kernel-azureUpgrade kernel-debug-vdsoUpgrade dlm-kmp-defaultUpgrade kernel-64kb-optionalUpgrade kernel-default-develUpgrade kernel-obs-buildUpgrade kselftests-kmp-rtUpgrade kernel-default-livepatchUpgrade kernel-rt_debug-develUpgrade kernel-kvmsmallUpgrade kernel-default-baseUpgrade kernel-kvmsmall-vdsoUpgrade kernel-rt-vdsoUpgrade kernel-macrosUpgrade cluster-md-kmp-azureUpgrade kernel-azure-develUpgrade kernel-docs-htmlUpgrade kernel-obs-qaUpgrade dlm-kmp-azureUpgrade dtb-amlogicUpgrade ocfs2-kmp-64kbUpgrade gfs2-kmp-rtUpgrade dtb-broadcomUpgrade kernel-source-vanillaUpgrade dtb-amdUpgrade dtb-freescaleUpgrade cluster-md-kmp-64kbUpgrade kernel-source-rtUpgrade kernel-rt-livepatch-develUpgrade kernel-rt_debug-vdsoUpgrade kselftests-kmp-azureUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-docsUpgrade kselftests-kmp-defaultUpgrade cluster-md-kmp-defaultUpgrade dlm-kmp-rtUpgrade kernel-rt-extraUpgrade kernel-azure-optionalUpgrade kernel-rt_debugUpgrade dtb-renesasUpgrade ocfs2-kmp-rtUpgrade dtb-xilinxUpgrade kernel-64kb-extraUpgrade kernel-default-vdsoUpgrade gfs2-kmp-64kbUpgrade dtb-mediatekUpgrade kernel-kvmsmall-develUpgrade reiserfs-kmp-azureUpgrade ocfs2-kmp-defaultUpgrade kernel-rt_debug-livepatch-develUpgrade ocfs2-kmp-azureUpgrade gfs2-kmp-azureUpgrade kernel-devel-rtUpgrade dtb-armUpgrade reiserfs-kmp-defaultUpgrade kernel-zfcpdumpUpgrade kernel-symsUpgrade kernel-64kb-develUpgrade gfs2-kmp-defaultUpgrade dtb-alteraUpgrade kernel-sourceUpgrade kernel-rt-develUpgrade dtb-nvidiaUpgrade kernel-default-base-rebuildUpgrade kernel-rtUpgrade dtb-qcomUpgrade dtb-caviumUpgrade cluster-md-kmp-rtUpgrade kernel-default-optionalUpgrade kselftests-kmp-64kbUpgrade kernel-develUpgrade dtb-rockchipUpgrade dtb-exynosUpgrade dtb-apmUpgrade kernel-debugUpgrade kernel-64kb-livepatch-develUpgrade dtb-allwinnerUpgrade kernel-defaultUpgrade kernel-syms-azureUpgrade dtb-hisiliconUpgrade dlm-kmp-64kb | Aug 8, 2024 | Apr 4, 2024 |
| Ubuntu | — | Upgrade linux-raspi-realtime | Feb 11, 2025 | Apr 4, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub