{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-89449", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.706Z", "datePublished": "2026-09-11T19:43:15.397Z", "dateUpdated": "2026-09-11T19:43:15.397Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-11T19:43:15.397Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu: Fix dev_iommu memory leak when device_add fails in iommu_mock_device_add\n\niommu_mock_device_add() first calls iommu_fwspec_init(), which on\nsuccess allocates both dev->iommu (via dev_iommu_get()) and\ndev->iommu->fwspec. If the subsequent device_add(dev) call fails,\nthe error path only calls iommu_fwspec_free(dev), which frees\nfwspec but leaves dev->iommu still allocated.\n\nThis triggers the following kmemleak report when fuzzing with Syzkaller:\n\nBUG: memory leak\nunreferenced object 0xffff888011e0a200 (size 192):\n comm \"syz.1.1695\", pid 24885, jiffies 4295222527\n hex dump (first 32 bytes):\n 00 00 00 00 00 00 00 00 00 00 00 00 ad 4e ad de .............N..\n ff ff ff ff 00 00 00 00 ff ff ff ff ff ff ff ff ................\n backtrace (crc 25df5bb3):\n kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]\n slab_post_alloc_hook mm/slub.c:4575 [inline]\n slab_alloc_node mm/slub.c:4899 [inline]\n __kmalloc_cache_noprof+0x47a/0x710 mm/slub.c:5415\n kmalloc_noprof include/linux/slab.h:950 [inline]\n kzalloc_noprof include/linux/slab.h:1188 [inline]\n dev_iommu_get+0x10c/0x1a0 drivers/iommu/iommu.c:408\n iommu_fwspec_init+0x288/0x4d0 drivers/iommu/iommu.c:3087\n iommu_mock_device_add+0x46/0xb0 drivers/iommu/iommu.c:385\n mock_dev_create drivers/iommu/iommufd/selftest.c:1025 [inline]\n iommufd_test_mock_domain drivers/iommu/iommufd/selftest.c:1066 [inline]\n iommufd_test+0x2f8a/0x6190 drivers/iommu/iommufd/selftest.c:2072\n iommufd_fops_ioctl+0x367/0x540 drivers/iommu/iommufd/main.c:533\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:597 [inline]\n __se_sys_ioctl fs/ioctl.c:583 [inline]\n __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0x116/0x800 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFix this by calling dev_iommu_free(dev) instead of iommu_fwspec_free(dev)\nin the device_add() failure path. dev_iommu_free() frees both fwspec\nand the outer dev_iommu struct and clears dev->iommu."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/iommu/iommu.c"], "versions": [{"version": "2a918911ed3d0841923525ed0fe707762ee78844", "lessThan": "f80f3acb69164800051ecdee871b6b006cbc2e66", "status": "affected", "versionType": "git"}, {"version": "2a918911ed3d0841923525ed0fe707762ee78844", "lessThan": "eaf44262af24810d16800b988c92dfce90f73370", "status": "affected", "versionType": "git"}, {"version": "2a918911ed3d0841923525ed0fe707762ee78844", "lessThan": "b7b0b3851474883d4aba6ed72da87141204b23e5", "status": "affected", "versionType": "git"}, {"version": "1daf67217b0d0bf88ef7208d7fbeefe2378c6590", "status": "affected", "versionType": "git"}, {"version": "6.17.3", "lessThan": "6.18", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/iommu/iommu.c"], "versions": [{"version": "6.18", "status": "affected"}, {"version": "0", "lessThan": "6.18", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.50", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.4", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "6.18.50"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "7.2.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "7.3-rc1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/f80f3acb69164800051ecdee871b6b006cbc2e66"}, {"url": "https://git.kernel.org/stable/c/eaf44262af24810d16800b988c92dfce90f73370"}, {"url": "https://git.kernel.org/stable/c/b7b0b3851474883d4aba6ed72da87141204b23e5"}], "title": "iommu: Fix dev_iommu memory leak when device_add fails in iommu_mock_device_add", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/iommu/iommu.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "f80f3acb69164800051ecdee871b6b006cbc2e66", "status": "affected", "version": "2a918911ed3d0841923525ed0fe707762ee78844", "versionType": "git"}, {"lessThan": "eaf44262af24810d16800b988c92dfce90f73370", "status": "affected", "version": "2a918911ed3d0841923525ed0fe707762ee78844", "versionType": "git"}, {"lessThan": "b7b0b3851474883d4aba6ed72da87141204b23e5", "status": "affected", "version": "2a918911ed3d0841923525ed0fe707762ee78844", "versionType": "git"}, {"status": "affected", "version": "1daf67217b0d0bf88ef7208d7fbeefe2378c6590", "versionType": "git"}, {"lessThan": "6.18", "status": "affected", "version": "6.17.3", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/iommu/iommu.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.18"}, {"lessThan": "6.18", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.50", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu: Fix dev_iommu memory leak when device_add fails in iommu_mock_device_add\n\niommu_mock_device_add() first calls iommu_fwspec_init(), which on\nsuccess allocates both dev->iommu (via dev_iommu_get()) and\ndev->iommu->fwspec. If the subsequent device_add(dev) call fails,\nthe error path only calls iommu_fwspec_free(dev), which frees\nfwspec but leaves dev->iommu still allocated.\n\nThis triggers the following kmemleak report when fuzzing with Syzkaller:\n\nBUG: memory leak\nunreferenced object 0xffff888011e0a200 (size 192):\n comm \"syz.1.1695\", pid 24885, jiffies 4295222527\n hex dump (first 32 bytes):\n 00 00 00 00 00 00 00 00 00 00 00 00 ad 4e ad de .............N..\n ff ff ff ff 00 00 00 00 ff ff ff ff ff ff ff ff ................\n backtrace (crc 25df5bb3):\n kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]\n slab_post_alloc_hook mm/slub.c:4575 [inline]\n slab_alloc_node mm/slub.c:4899 [inline]\n __kmalloc_cache_noprof+0x47a/0x710 mm/slub.c:5415\n kmalloc_noprof include/linux/slab.h:950 [inline]\n kzalloc_noprof include/linux/slab.h:1188 [inline]\n dev_iommu_get+0x10c/0x1a0 drivers/iommu/iommu.c:408\n iommu_fwspec_init+0x288/0x4d0 drivers/iommu/iommu.c:3087\n iommu_mock_device_add+0x46/0xb0 drivers/iommu/iommu.c:385\n mock_dev_create drivers/iommu/iommufd/selftest.c:1025 [inline]\n iommufd_test_mock_domain drivers/iommu/iommufd/selftest.c:1066 [inline]\n iommufd_test+0x2f8a/0x6190 drivers/iommu/iommufd/selftest.c:2072\n iommufd_fops_ioctl+0x367/0x540 drivers/iommu/iommufd/main.c:533\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:597 [inline]\n __se_sys_ioctl fs/ioctl.c:583 [inline]\n __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0x116/0x800 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFix this by calling dev_iommu_free(dev) instead of iommu_fwspec_free(dev)\nin the device_add() failure path. dev_iommu_free() frees both fwspec\nand the outer dev_iommu struct and clears dev->iommu."}], "id": "CVE-2026-89449", "lastModified": "2026-09-11T20:19:25.473", "metrics": {}, "published": "2026-09-11T20:19:25.473", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b7b0b3851474883d4aba6ed72da87141204b23e5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/eaf44262af24810d16800b988c92dfce90f73370"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f80f3acb69164800051ecdee871b6b006cbc2e66"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Linux kernel: Memory leak in IOMMU subsystem can lead to denial of service", "id": "2532262", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532262"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-772", "details": ["A flaw was found in the Linux kernel's Input-Output Memory Management Unit (IOMMU) subsystem. When a device addition fails during the `iommu_mock_device_add()` operation, the allocated device IOMMU structure is not properly deallocated. This oversight leads to a memory leak, which over time could be exploited by a local attacker to cause a denial of service (DoS) by exhausting system memory."], "name": "CVE-2026-89449", "public_date": "2026-09-11T19:43:15Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-89449\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-89449\nhttps://git.kernel.org/stable/c/b7b0b3851474883d4aba6ed72da87141204b23e5\nhttps://git.kernel.org/stable/c/eaf44262af24810d16800b988c92dfce90f73370\nhttps://git.kernel.org/stable/c/f80f3acb69164800051ecdee871b6b006cbc2e66"], "threat_severity": "Moderate"}

{"created": "2026-09-12T03:15:06.701024+00:00", "updated": "2026-09-12T03:15:06.701035+00:00", "vendors": []}