In the Linux kernel, the following vulnerability has been resolved:
iommu: Fix WARN_ON in __iommu_group_set_domain_nofail() due to reset
In __iommu_group_set_domain_internal(), concurrent domain attachments are rejected when any device in the group is recovering. This is necessary to fence concurrent attachments to a multi-device group where devices might share the same RID due to PCI DMA alias quirks, but triggers the WARN_ON in __iommu_group_set_domain_nofail().
Other IOMMU_SET_DOMAIN_MUST_SUCCEED callers in detach/teardown paths, such as __iommu_group_set_core_domain and __iommu_release_dma_ownership, should not be rejected, as the domain would be freed anyway in these nofail paths while group->domain is still pointing to it. So pci_dev_reset_iommu_done() could trigger a UAF when re-attaching group->domain.
Honor the IOMMU_SET_DOMAIN_MUST_SUCCEED flag, allowing the callers through the group->recovery_cnt fence, so as to update the group->domain pointer. Instead add a gdev->blocked check in the device iteration loop, to prevent any concurrent per-device detachment.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Ubuntu | — | Upgrade linux-image-ibm-7.0Upgrade linux-image-7.0.0-1009-aws-64kUpgrade linux-image-oem-7.0Upgrade linux-image-7.0.0-28-genericUpgrade linux-image-oem-26.04aUpgrade linux-image-gcp-64kUpgrade linux-image-azureUpgrade linux-image-7.0.0-1008-gcpUpgrade linux-image-virtual-hwe-26.04Upgrade linux-image-nvidia-64kUpgrade linux-image-7.0.0-1008-oracle-64kUpgrade linux-image-azure-fde-7.0Upgrade linux-image-ibmUpgrade linux-image-realtime-64k-hwe-26.04Upgrade linux-image-gke-64kUpgrade linux-image-raspiUpgrade linux-image-nvidia-64k-7.0Upgrade linux-image-azure-fdeUpgrade linux-image-generic-64kUpgrade linux-image-oracle-7.0Upgrade linux-image-7.0.0-1011-gcpUpgrade linux-image-nvidiaUpgrade linux-image-7.0.0-1011-gcp-64kUpgrade linux-image-realtime-hwe-26.04Upgrade linux-image-7.0.0-1016-nvidiaUpgrade linux-image-gke-64k-7.0Upgrade linux-image-nvidia-7.0Upgrade linux-image-genericUpgrade linux-image-7.0.0-1009-oemUpgrade linux-image-7.0.0-1010-ibmUpgrade linux-image-7.0.0-1016-nvidia-64kUpgrade linux-image-7.0.0-1009-awsUpgrade linux-image-oem-26.04Upgrade linux-image-oem-24.04Upgrade linux-image-7.0.0-1009-azure-fdeUpgrade linux-image-oracle-64k-7.0Upgrade linux-image-oem-24.04dUpgrade linux-image-oem-24.04bUpgrade linux-image-gke-64k-hwe-26.04Upgrade linux-image-raspi-realtimeUpgrade linux-image-generic-64k-hwe-26.04Upgrade linux-image-gcp-64k-7.0Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-7.0.0-1003-gkeUpgrade linux-image-virtualUpgrade linux-image-7.0.0-28-realtime-64kUpgrade linux-image-7.0.0-1010-azureUpgrade linux-image-generic-64k-7.0Upgrade linux-image-realtimeUpgrade linux-image-awsUpgrade linux-image-7.0.0-28-generic-64kUpgrade linux-image-7.0.0-1015-raspi-realtimeUpgrade linux-image-7.0.0-1008-oracleUpgrade linux-image-7.0.0-1003-gke-64kUpgrade linux-image-generic-hwe-26.04Upgrade linux-image-gcpUpgrade linux-image-gke-hwe-26.04Upgrade linux-image-gkeUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-7.0.0-28-realtimeUpgrade linux-image-aws-7.0Upgrade linux-image-generic-7.0Upgrade linux-image-realtime-64k-7.0Upgrade linux-image-oem-24.04cUpgrade linux-image-7.0.0-1008-gcp-64kUpgrade linux-image-azure-7.0Upgrade linux-image-aws-64k-7.0Upgrade linux-image-aws-64kUpgrade linux-image-7.0.0-1015-raspiUpgrade linux-image-virtual-7.0Upgrade linux-image-realtime-7.0Upgrade linux-image-raspi-realtime-7.0Upgrade linux-image-raspi-7.0Upgrade linux-image-gke-7.0Upgrade linux-image-oracleUpgrade linux-image-7.0.0-1014-azureUpgrade linux-image-oracle-64kUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-gcp-7.0Upgrade linux-image-oem-24.04aUpgrade linux-image-realtime-64k | Jul 20, 2026 | Jun 24, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub