CVE-2026-89453

LOW impact Linux kernel flaw in the AMD IOMMU driver's Peripheral Page Request (PPR) fault handling affecting current Red Hat Enterprise Linux 9 and 10 kernel and kernel-rt streams and OpenShift Container Platform 4.19 and later releases, which ship a RHEL 9 based kernel in RHCOS. When a PPR fault is handled, iommu_call_iopf_notifier() looks up the requesting PCI device with pci_get_domain_bus_and_slot(), which returns the device with its reference count incremented, but neither the successful iommu_report_device_fault() path nor the abort path drops that reference, so every handled PPR request leaks a PCI device reference. A local attacker able to trigger repeated PPR/IOPF faults on a system with AMD IOMMU hardware could gradually exhaust kernel resources and cause a denial of service; confidentiality and integrity are not affected. Red Hat assigned a CVSS 3.1 base score of 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, MODERATE) while rating the overall impact LOW, since exploitation requires local access and repeated fault generation and only availability is affected. The vulnerable iommu_call_iopf_notifier() code in drivers/iommu/amd/ppr.c was introduced upstream in Linux 6.10, so earlier Red Hat Enterprise Linux 6, 7, 8, and RHEL 9.2/9.4 streams and earlier OpenShift releases are not affected because the vulnerable code is not present in their kernels. For the affected streams the fix is deferred (DEFER): the flaw is of moderate severity with a CVSS score below 7.0, so no update tracker is currently filed, and the residual risk is limited to gradual local resource exhaustion and denial of service on AMD IOMMU systems where PPR faults are repeatedly generated.