GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-80633 (GCVE-0-2026-80633)

Vulnerability from cvelistv5 – Published: 2026-08-28 06:48 – Updated: 2026-08-29 06:21
VLAI
Title
iommufd: Take dma_resv lock before dma_buf_unpin() in release path
Summary
In the Linux kernel, the following vulnerability has been resolved: iommufd: Take dma_resv lock before dma_buf_unpin() in release path dma_buf_unpin() requires the caller to hold the exporter's dma_resv lock: void dma_buf_unpin(struct dma_buf_attachment *attach) { ... dma_resv_assert_held(dmabuf->resv); ... } iopt_release_pages() calls dma_buf_unpin() without taking that lock, so every iommufd_ioas_destroy()/iommufd_ioas_unmap() that releases the last reference on a DMABUF-backed iopt_pages triggers a WARN. This was hit while running tools/testing/selftests/iommu/iommufd: WARNING: drivers/dma-buf/dma-buf.c:1137 at dma_buf_unpin+0x62/0x70 RIP: 0010:dma_buf_unpin+0x62/0x70 Call Trace: <TASK> dma_buf_unpin+0x62/0x70 iopt_release_pages+0xe4/0x190 iopt_unmap_iova_range+0x1c7/0x290 iopt_unmap_all+0x1a/0x30 iommufd_ioas_destroy+0x1d/0x50 iommufd_fops_release+0x93/0x150 __fput+0xfc/0x2c0 __x64_sys_close+0x3d/0x80 do_syscall_64+0x65/0x180 </TASK> Take the dma_resv lock around dma_buf_unpin() in iopt_release_pages(), matching the iopt_map_dmabuf() convention. dma_buf_detach() acquires the reservation lock internally, so it must remain outside the locked region.
Severity
8.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 8c5f9645c3893f0db679d9affe4fe4e665b990dd , < cc69d0332421fd2943b66dbe5e597bf4fd5af126 (git)
Affected: 8c5f9645c3893f0db679d9affe4fe4e665b990dd , < e745cd2c749e557c14a15ac931761c3f58c24489 (git)
guessed Create a notification for this product.
Linux Linux Affected: 7.1
Unaffected: 0 , < 7.1 (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/iommufd/pages.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cc69d0332421fd2943b66dbe5e597bf4fd5af126",
              "status": "affected",
              "version": "8c5f9645c3893f0db679d9affe4fe4e665b990dd",
              "versionType": "git"
            },
            {
              "lessThan": "e745cd2c749e557c14a15ac931761c3f58c24489",
              "status": "affected",
              "version": "8c5f9645c3893f0db679d9affe4fe4e665b990dd",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/iommufd/pages.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.1"
            },
            {
              "lessThan": "7.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommufd: Take dma_resv lock before dma_buf_unpin() in release path\n\ndma_buf_unpin() requires the caller to hold the exporter\u0027s dma_resv\nlock:\n\n  void dma_buf_unpin(struct dma_buf_attachment *attach)\n  {\n          ...\n          dma_resv_assert_held(dmabuf-\u003eresv);\n          ...\n  }\n\niopt_release_pages() calls dma_buf_unpin() without taking that lock,\nso every iommufd_ioas_destroy()/iommufd_ioas_unmap() that releases\nthe last reference on a DMABUF-backed iopt_pages triggers a WARN.\nThis was hit while running tools/testing/selftests/iommu/iommufd:\n\n  WARNING: drivers/dma-buf/dma-buf.c:1137 at dma_buf_unpin+0x62/0x70\n  RIP: 0010:dma_buf_unpin+0x62/0x70\n  Call Trace:\n   \u003cTASK\u003e\n   dma_buf_unpin+0x62/0x70\n   iopt_release_pages+0xe4/0x190\n   iopt_unmap_iova_range+0x1c7/0x290\n   iopt_unmap_all+0x1a/0x30\n   iommufd_ioas_destroy+0x1d/0x50\n   iommufd_fops_release+0x93/0x150\n   __fput+0xfc/0x2c0\n   __x64_sys_close+0x3d/0x80\n   do_syscall_64+0x65/0x180\n   \u003c/TASK\u003e\n\nTake the dma_resv lock around dma_buf_unpin() in iopt_release_pages(),\nmatching the iopt_map_dmabuf() convention. dma_buf_detach() acquires the\nreservation lock internally, so it must remain outside the locked region."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only via local syscalls on /dev/iommu or VFIO-compat iommufd: open, IOMMU_IOAS_MAP_FILE with a dma-buf fd, then IOMMU_IOAS_UNMAP/close triggers iopt_release_pages()-\u003edma_buf_unpin(); no network or packet handler is involved.\nAC:L - Every teardown of the last dma-buf-backed iopt_pages deterministically hits dma_buf_unpin() without dma_resv; an attacker also controls concurrent invalidate/revoke via IOMMU_IOAS_UNMAP and dma_buf_invalidate_mappings (selftest revoke or VFIO PCI dmabuf revoke).\nPR:L - No init-namespace root or special capability is required for the IOAS map/unmap path once a process can open iommufd (0660) and hold a compatible dma-buf fd, as in cloud GPU/VFIO passthrough tenants or iommufd selftests.\nUI:N - Exploitation requires no victim interaction; the attacker programmatically creates the IOAS dma-buf mapping and drives unmap/close and optional concurrent revoke through their own file descriptors and ioctl calls.\nS:C - Missing dma_resv locking during dma-buf unpin/detach races dma_buf_invalidate_mappings and can leave stale IOMMU IOVA-to-physical mappings or permit buffer movement while DMA views remain, breaking the IOMMU/DMA isolation boundary.\nC:H - Concurrent dma_resv-protected invalidation during unpin without the reservation lock can race teardown of iopt_pages/dmabuf attachments and yield kernel heap use-after-free or stale mapping visibility exploitable for arbitrary kernel memory read.\nI:H - Racing unpin without dma_resv against invalidate/revoke can leave IOMMU page tables pointing at repinned/moved exporter pages, giving a device DMA write primitive to attacker-influenced physical memory and enabling control-flow corruption.\nA:H - The missing lock triggers dma_resv_assert_held WARN on every dma-buf IOAS unmap/destroy (reproduced in iommufd selftests), and concurrent teardown races can provoke kernel oops/panic or wedge GPU/VFIO+iommufd workloads."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-29T06:21:32.731Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cc69d0332421fd2943b66dbe5e597bf4fd5af126"
        },
        {
          "url": "https://git.kernel.org/stable/c/e745cd2c749e557c14a15ac931761c3f58c24489"
        }
      ],
      "title": "iommufd: Take dma_resv lock before dma_buf_unpin() in release path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80633",
    "datePublished": "2026-08-28T06:48:48.372Z",
    "dateReserved": "2026-08-26T14:34:25.776Z",
    "dateUpdated": "2026-08-29T06:21:32.731Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80633",
      "date": "2026-09-16",
      "epss": "0.0012",
      "percentile": "0.02115"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-80633\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-28T08:16:48.200\",\"lastModified\":\"2026-08-29T07:16:47.320\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\niommufd: Take dma_resv lock before dma_buf_unpin() in release path\\n\\ndma_buf_unpin() requires the caller to hold the exporter\u0027s dma_resv\\nlock:\\n\\n  void dma_buf_unpin(struct dma_buf_attachment *attach)\\n  {\\n          ...\\n          dma_resv_assert_held(dmabuf-\u003eresv);\\n          ...\\n  }\\n\\niopt_release_pages() calls dma_buf_unpin() without taking that lock,\\nso every iommufd_ioas_destroy()/iommufd_ioas_unmap() that releases\\nthe last reference on a DMABUF-backed iopt_pages triggers a WARN.\\nThis was hit while running tools/testing/selftests/iommu/iommufd:\\n\\n  WARNING: drivers/dma-buf/dma-buf.c:1137 at dma_buf_unpin+0x62/0x70\\n  RIP: 0010:dma_buf_unpin+0x62/0x70\\n  Call Trace:\\n   \u003cTASK\u003e\\n   dma_buf_unpin+0x62/0x70\\n   iopt_release_pages+0xe4/0x190\\n   iopt_unmap_iova_range+0x1c7/0x290\\n   iopt_unmap_all+0x1a/0x30\\n   iommufd_ioas_destroy+0x1d/0x50\\n   iommufd_fops_release+0x93/0x150\\n   __fput+0xfc/0x2c0\\n   __x64_sys_close+0x3d/0x80\\n   do_syscall_64+0x65/0x180\\n   \u003c/TASK\u003e\\n\\nTake the dma_resv lock around dma_buf_unpin() in iopt_release_pages(),\\nmatching the iopt_map_dmabuf() convention. dma_buf_detach() acquires the\\nreservation lock internally, so it must remain outside the locked region.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/iommu/iommufd/pages.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"8c5f9645c3893f0db679d9affe4fe4e665b990dd\",\"lessThan\":\"cc69d0332421fd2943b66dbe5e597bf4fd5af126\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8c5f9645c3893f0db679d9affe4fe4e665b990dd\",\"lessThan\":\"e745cd2c749e557c14a15ac931761c3f58c24489\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/iommu/iommufd/pages.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7.1\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"7.1\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.0,\"impactScore\":6.0}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/cc69d0332421fd2943b66dbe5e597bf4fd5af126\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e745cd2c749e557c14a15ac931761c3f58c24489\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-31T09:07:54+00:00",
      "cve": "CVE-2026-80633",
      "id": "CVE-2026-80633",
      "initial_release_date": "2026-08-28T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: iommufd: Take dma_resv lock before dma_buf_unpin() in release path",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80633.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-03T00:04:48Z",
      "cve": "CVE-2026-80633",
      "id": "CVE-2026-80633",
      "initial_release_date": "2026-08-28T16:35:42Z",
      "product_status:known_not_affected": "353",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-80633",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-80633.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.