{
  "threat_severity" : "Moderate",
  "public_date" : "2026-09-11T19:43:12Z",
  "bugzilla" : {
    "description" : "kernel: Linux Kernel: Use-After-Free vulnerability in iommufd selftest",
    "id" : "2532116",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2532116"
  },
  "cvss3" : {
    "cvss3_base_score" : "4.1",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H",
    "status" : "draft"
  },
  "cwe" : "CWE-825",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\niommufd: Fix UAF in selftest IOPF reporting\nIOMMUFD selftest TRIGGER_IOPF borrows an attach handle from\ngroup->pasid_array without synchronizing against PASID detach,\nthen a concurrent iommu_report_device_fault() can dereference\nthat borrowed handle's domain pointer after the detach erases\nthe handle and frees the backing struct iommufd_attach_handle.\nTRIGGER_IOPF then dereferences the freed handle, causing a UAF.\nFix by adding a iopf_rwsem in mock_dev to follow the expected design\nof a real driver. Hold its read side across the whole\niommu_report_device_fault() call, and its write side around every\npath that attaches, detaches, or replaces a device domain.\nThis can block new reports and drains in-flight reports before an old\nattach handle or the IOPF fault parameter can be removed.\nAlso take the write side while registering a mock device, since\nit can invoke the mock driver's default-domain attach callback.", "A flaw was found in the Linux kernel's iommufd selftest component. This Use-After-Free (UAF) vulnerability occurs when the TRIGGER_IOPF function borrows an attach handle without proper synchronization during a PASID detach operation. A concurrent device fault report can then access memory that has been freed, leading to system instability, potential information disclosure, or arbitrary code execution." ],
  "package_state" : [ {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Fix deferred",
    "package_name" : "openshift/ose-rhel-coreos-8",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Fix deferred",
    "package_name" : "openshift/ose-rhel-coreos-9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-89445\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-89445\nhttps://git.kernel.org/stable/c/8c07df7cdfcf52f1ff276c588612aabc6c6b8399\nhttps://git.kernel.org/stable/c/cab2895729516799384d48560e6fca105fb3f927\nhttps://git.kernel.org/stable/c/e27e90bde68b2ab92e63ed19caad1ef57188bea0" ],
  "name" : "CVE-2026-89445",
  "csaw" : false
}