CVE-2026-52952
Description
A flaw was found in the Linux kernel's Input/Output Memory Management Unit (IOMMU) subsystem, which manages how devices access system memory. A race condition, a situation where multiple operations occur in an unpredictable order, exists during device recovery when multiple memory domains are being attached concurrently. This can lead to a Use-After-Free (UAF) vulnerability, where the system attempts to use memory that has already been released, potentially allowing a local attacker to execute unauthorized code or cause the system to crash (denial of service).
Statement
A flaw rated IMPORTANT by Red Hat Product Security was found in the Linux kernel's IOMMU subsystem. When any device in an IOMMU group is recovering, concurrent domain attachments are rejected; this fence also incorrectly rejects IOMMU_SET_DOMAIN_MUST_SUCCEED callers in detach/teardown paths such as __iommu_group_set_core_domain() and __iommu_release_dma_ownership(). In those nofail paths the domain is freed anyway while group->domain still points to it, so pci_dev_reset_iommu_done() can later re-attach the stale domain pointer, resulting in a use-after-free. A local attacker able to trigger PCI device resets and concurrent IOMMU domain attachment operations could exploit this race condition to crash the system (denial of service) or potentially execute arbitrary code in the kernel. The Red Hat CVSS 3.1 score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) matches the CVEORG severity. The vulnerable code was introduced with the pci_dev_reset_iommu_prepare/done() mechanism and is not present in earlier Red Hat Enterprise Linux releases (RHEL 6, 7, 8, 9, and RHEL 10.0.z/10.2.z streams), so those products are not affected. Red Hat Enterprise Linux 10.3 and Red Hat In-Vehicle OS 2.0/2.1 kernel and kernel-ivos-qualcomm components are affected; fixes are being pursued for these delegated product streams.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7 | N/A | 7 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | High | N/A | High |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
