In the Linux kernel, the following vulnerability has been resolved:
iommufd: Fix iopt_access_list_id overwrite bug
Syzkaller reported the following WARN_ON: WARNING: CPU: 1 PID: 4738 at drivers/iommu/iommufd/io_pagetable.c:1360
Call Trace: iommufd_access_change_ioas+0x2fe/0x4e0 iommufd_access_destroy_object+0x50/0xb0 iommufd_object_remove+0x2a3/0x490 iommufd_object_destroy_user iommufd_access_destroy+0x71/0xb0 iommufd_test_staccess_release+0x89/0xd0 __fput+0x272/0xb50 __fput_sync+0x4b/0x60 __do_sys_close __se_sys_close __x64_sys_close+0x8b/0x110 do_syscall_x64
The mismatch between the access pointer in the list and the passed-in pointer is resulting from an overwrite of access->iopt_access_list_id, in iopt_add_access(). Called from iommufd_access_change_ioas() when xa_alloc() succeeds but iopt_calculate_iova_alignment() fails.
Add a new_id in iopt_add_access() and only update iopt_access_list_id when returning successfully.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 27, 2026 | Jul 27, 2026 |
| Redhat_linux | — | Upgrade kernel-rtNo solution existsUpgrade kernel | Dec 5, 2024 | Apr 4, 2024 |
| Suse | — | Upgrade kernel-rt-develUpgrade kernel-source-azureUpgrade kernel-syms-rtUpgrade dtb-amazonUpgrade cluster-md-kmp-defaultUpgrade kernel-debug-livepatch-develUpgrade kernel-sourceUpgrade kernel-64kb-develUpgrade dlm-kmp-64kbUpgrade dtb-amdUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-azure-develUpgrade kernel-rt_debug-vdsoUpgrade kernel-symsUpgrade cluster-md-kmp-azureUpgrade kernel-syms-azureUpgrade kernel-64kb-livepatch-develUpgrade kernel-kvmsmall-develUpgrade kselftests-kmp-64kbUpgrade gfs2-kmp-rtUpgrade kernel-azure-optionalUpgrade kernel-zfcpdumpUpgrade kernel-64kbUpgrade kernel-azure-extraUpgrade dtb-hisiliconUpgrade kernel-devel-azureUpgrade kernel-debugUpgrade dtb-alteraUpgrade kernel-default-livepatchUpgrade dtb-broadcomUpgrade dtb-marvellUpgrade dtb-exynosUpgrade dtb-apmUpgrade ocfs2-kmp-64kbUpgrade gfs2-kmp-64kbUpgrade kernel-kvmsmallUpgrade kernel-rt_debugUpgrade dtb-appleUpgrade kernel-default-develUpgrade kernel-azure-vdsoUpgrade kernel-azure-livepatch-develUpgrade kernel-macrosUpgrade kernel-default-extraUpgrade kernel-debug-develUpgrade dtb-amlogicUpgrade dtb-lgUpgrade kernel-rtUpgrade dtb-mediatekUpgrade dtb-xilinxUpgrade dtb-freescaleUpgrade kernel-64kb-optionalUpgrade kernel-docs-htmlUpgrade kernel-devel-rtUpgrade kernel-obs-qaUpgrade kernel-rt-livepatch-develUpgrade ocfs2-kmp-rtUpgrade kernel-default-vdsoUpgrade dtb-qcomUpgrade kernel-kvmsmall-vdsoUpgrade kernel-64kb-extraUpgrade dtb-renesasUpgrade dtb-socionextUpgrade kernel-docsUpgrade kernel-default-baseUpgrade kernel-azureUpgrade gfs2-kmp-azureUpgrade cluster-md-kmp-rtUpgrade dtb-allwinnerUpgrade dtb-sprdUpgrade dtb-caviumUpgrade reiserfs-kmp-defaultUpgrade kselftests-kmp-rtUpgrade kernel-rt_debug-develUpgrade kernel-defaultUpgrade kernel-default-base-rebuildUpgrade dtb-nvidiaUpgrade dlm-kmp-azureUpgrade gfs2-kmp-defaultUpgrade ocfs2-kmp-defaultUpgrade kernel-rt-extraUpgrade kernel-develUpgrade kernel-default-optionalUpgrade ocfs2-kmp-azureUpgrade kernel-source-rtUpgrade kselftests-kmp-azureUpgrade dlm-kmp-defaultUpgrade kernel-rt-optionalUpgrade dlm-kmp-rtUpgrade reiserfs-kmp-64kbUpgrade kernel-rt_debug-livepatch-develUpgrade dtb-armUpgrade kernel-source-vanillaUpgrade dtb-rockchipUpgrade reiserfs-kmp-rtUpgrade kernel-rt-vdsoUpgrade kernel-obs-buildUpgrade cluster-md-kmp-64kbUpgrade kernel-default-livepatch-develUpgrade kselftests-kmp-defaultUpgrade kernel-debug-vdsoUpgrade reiserfs-kmp-azure | Jun 24, 2024 | Apr 4, 2024 |
| Ubuntu | — | Upgrade linux-raspi-realtime | Feb 11, 2025 | Apr 4, 2024 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub