CVE-2026-89445

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> iommufd: Fix UAF in selftest IOPF reporting<br /> <br /> IOMMUFD selftest TRIGGER_IOPF borrows an attach handle from<br /> group-&gt;pasid_array without synchronizing against PASID detach,<br /> then a concurrent iommu_report_device_fault() can dereference<br /> that borrowed handle&amp;#39;s domain pointer after the detach erases<br /> the handle and frees the backing struct iommufd_attach_handle.<br /> TRIGGER_IOPF then dereferences the freed handle, causing a UAF.<br /> <br /> Fix by adding a iopf_rwsem in mock_dev to follow the expected design<br /> of a real driver. Hold its read side across the whole<br /> iommu_report_device_fault() call, and its write side around every<br /> path that attaches, detaches, or replaces a device domain.<br /> This can block new reports and drains in-flight reports before an old<br /> attach handle or the IOPF fault parameter can be removed.<br /> Also take the write side while registering a mock device, since<br /> it can invoke the mock driver&amp;#39;s default-domain attach callback.