CVE-2026-23429
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
03/04/2026
Last modified:
03/04/2026
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
iommu/sva: Fix crash in iommu_sva_unbind_device()<br />
<br />
domain->mm->iommu_mm can be freed by iommu_domain_free():<br />
iommu_domain_free()<br />
mmdrop()<br />
__mmdrop()<br />
mm_pasid_drop()<br />
After iommu_domain_free() returns, accessing domain->mm->iommu_mm may<br />
dereference a freed mm structure, leading to a crash.<br />
<br />
Fix this by moving the code that accesses domain->mm->iommu_mm to before<br />
the call to iommu_domain_free().