GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89452 (GCVE-0-2026-89452)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:43 – Updated: 2026-09-13 06:29
VLAI
Title
iommu/msm: Unwind probe state on registration failure
Summary
In the Linux kernel, the following vulnerability has been resolved: iommu/msm: Unwind probe state on registration failure msm_iommu_probe() adds its devm-managed IOMMU object to qcom_iommu_devices before adding the IOMMU sysfs device and registering it with the IOMMU core. If iommu_device_sysfs_add() fails, probe returns with the object still on qcom_iommu_devices. The driver core then releases the devm allocation, leaving a dangling list entry that later list walks may dereference. If iommu_device_register() fails, the same dangling list entry remains and the sysfs device is left registered as well. Unwind the sysfs device and global list entry in reverse setup order on the corresponding failure paths.
Severity
8.4 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 42df43b36163ed7d0ab13992e411093252903273 , < f532401be9312ecd166f616bb74a65b0b4c150fa (git)
Affected: 42df43b36163ed7d0ab13992e411093252903273 , < 7f7074a886c4a93e3d12076ce60a510a1ebe400c (git)
Affected: 42df43b36163ed7d0ab13992e411093252903273 , < 535a200220ca2c83bc8bf54bd2cbe045d6ee70c4 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.11
Unaffected: 0 , < 4.11 (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/msm_iommu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f532401be9312ecd166f616bb74a65b0b4c150fa",
              "status": "affected",
              "version": "42df43b36163ed7d0ab13992e411093252903273",
              "versionType": "git"
            },
            {
              "lessThan": "7f7074a886c4a93e3d12076ce60a510a1ebe400c",
              "status": "affected",
              "version": "42df43b36163ed7d0ab13992e411093252903273",
              "versionType": "git"
            },
            {
              "lessThan": "535a200220ca2c83bc8bf54bd2cbe045d6ee70c4",
              "status": "affected",
              "version": "42df43b36163ed7d0ab13992e411093252903273",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/msm_iommu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.11"
            },
            {
              "lessThan": "4.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/msm: Unwind probe state on registration failure\n\nmsm_iommu_probe() adds its devm-managed IOMMU object to\nqcom_iommu_devices before adding the IOMMU sysfs device and registering\nit with the IOMMU core.\n\nIf iommu_device_sysfs_add() fails, probe returns with the object still on\nqcom_iommu_devices. The driver core then releases the devm allocation,\nleaving a dangling list entry that later list walks may dereference.\n\nIf iommu_device_register() fails, the same dangling list entry remains\nand the sysfs device is left registered as well.\n\nUnwind the sysfs device and global list entry in reverse setup order on\nthe corresponding failure paths."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is in msm_iommu_probe() for the Qualcomm APQ8064 platform IOMMU (compatible qcom,apq8064-iommu). It is reached only through the local platform driver core at boot or sysfs bind, not via network protocols, Bluetooth/WiFi, or a physical USB/serial endpoint.\nAC:L - After list_add, a failed iommu_device_sysfs_add() or iommu_device_register() deterministically leaves a freed msm_iommu_dev on qcom_iommu_devices. APQ8064 has four IOMMU instances, so a later probe, of_xlate, or attach walks that list and dereferences the object with no attacker-uncontrolled race. GFP_ATOMIC allocation in insert_iommu_master during register can induce the failure.\nPR:N - msm_iommu_probe() and later list walks in qcom_iommu_of_xlate(), find_iommu_for_dev(), and msm_iommu_attach_dev() run from the platform/IOMMU core with no capable() or credential check. On APQ8064 phones and embedded boards this happens automatically during boot or deferred probe without a user account.\nUI:N - Platform probe and subsequent IOMMU client attach/xlate run unattended during normal kernel device bring-up. No victim action such as mounting a filesystem, opening a file, or clicking a prompt is required.\nS:U - The use-after-free corrupts host kernel heap through the driver\u0027s private qcom_iommu_devices list, enabling in-kernel privilege escalation. It does not by itself escape a VM or bypass the IOMMU/DMA isolation boundary as a distinct security authority.\nC:H - The dangling msm_iommu_dev stays linked after devm frees it. Subsequent list walks dereference attacker-influencable freed heap (including embedded list pointers and device state), which per kernel UAF guidance enables arbitrary kernel memory disclosure.\nI:H - Use-after-free of the IOMMU instance structure (list nodes, MMIO base, context-bank maps) allows heap spraying and hijack of later attach/xlate control flow, providing an arbitrary kernel write and code-execution primitive.\nA:H - Any later walk of qcom_iommu_devices after the failed probe dereferences freed memory and can oops or panic the kernel. Kernel UAFs also crash even when not turned into a full exploit."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:29:31.299Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f532401be9312ecd166f616bb74a65b0b4c150fa"
        },
        {
          "url": "https://git.kernel.org/stable/c/7f7074a886c4a93e3d12076ce60a510a1ebe400c"
        },
        {
          "url": "https://git.kernel.org/stable/c/535a200220ca2c83bc8bf54bd2cbe045d6ee70c4"
        }
      ],
      "title": "iommu/msm: Unwind probe state on registration failure",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89452",
    "datePublished": "2026-09-11T19:43:17.405Z",
    "dateReserved": "2026-09-11T19:38:34.706Z",
    "dateUpdated": "2026-09-13T06:29:31.299Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89452",
      "date": "2026-09-16",
      "epss": "0.0018",
      "percentile": "0.07868"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-15T01:55:11.000Z",
      "cve": "CVE-2026-89452",
      "id": "msrc_CVE-2026-89452",
      "initial_release_date": "2026-09-13T01:08:13.000Z",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "iommu/msm: Unwind probe state on registration failure",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-89452.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89452\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:25.843\",\"lastModified\":\"2026-09-13T07:17:09.477\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\niommu/msm: Unwind probe state on registration failure\\n\\nmsm_iommu_probe() adds its devm-managed IOMMU object to\\nqcom_iommu_devices before adding the IOMMU sysfs device and registering\\nit with the IOMMU core.\\n\\nIf iommu_device_sysfs_add() fails, probe returns with the object still on\\nqcom_iommu_devices. The driver core then releases the devm allocation,\\nleaving a dangling list entry that later list walks may dereference.\\n\\nIf iommu_device_register() fails, the same dangling list entry remains\\nand the sysfs device is left registered as well.\\n\\nUnwind the sysfs device and global list entry in reverse setup order on\\nthe corresponding failure paths.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/iommu/msm_iommu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"42df43b36163ed7d0ab13992e411093252903273\",\"lessThan\":\"f532401be9312ecd166f616bb74a65b0b4c150fa\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"42df43b36163ed7d0ab13992e411093252903273\",\"lessThan\":\"7f7074a886c4a93e3d12076ce60a510a1ebe400c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"42df43b36163ed7d0ab13992e411093252903273\",\"lessThan\":\"535a200220ca2c83bc8bf54bd2cbe045d6ee70c4\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/iommu/msm_iommu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.11\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.11\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.4,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.5,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/535a200220ca2c83bc8bf54bd2cbe045d6ee70c4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7f7074a886c4a93e3d12076ce60a510a1ebe400c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f532401be9312ecd166f616bb74a65b0b4c150fa\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-15T12:24:04+00:00",
      "cve": "CVE-2026-89452",
      "id": "CVE-2026-89452",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_not_affected": "276",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: iommu/msm: Unwind probe state on registration failure",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89452.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-16T00:03:38Z",
      "cve": "CVE-2026-89452",
      "id": "CVE-2026-89452",
      "initial_release_date": "2026-09-12T16:28:13Z",
      "product_status:known_affected": "347",
      "product_status:known_not_affected": "6",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89452",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89452.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.