CVE-2026-80894 is a vulnerability in Linux Kernel
Published on September 4, 2026
iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace
In the Linux kernel, the following vulnerability has been resolved:
iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace
iommufd_hwpt_replace_device() calls:
iommufd_auto_response_faults(hwpt, old_handle);
passing the *new* hwpt together with the handle of
the device's *old* domain. This should be a parameter mismatch:
1. Semantically, iommufd_auto_response_faults(x, handle) scans
x->fault's deliver list and response xarray for groups matching
"handle". A group is queued under the hwpt that was attached at
fault-delivery time. old_handle is fetched *before* the domain switch,
so its group lives on old->fault, not on the new hwpt->fault.
2. Historically, the first argument was "old". The routine was
introduced by commit b7d8833677ba ("iommufd: Fault-capable hwpt
attach/detach/replace") as __fault_domain_replace_dev() in
fault.c, correctly calling iommufd_auto_response_faults(old, curr).
Commit fb21b1568ada ("iommufd: Make attach_handle generic than
fault specific") moved this into iommufd_hwpt_replace_device() in
device.c and swapped it to "hwpt". This should be a refactor regression,
not an intentional change.
Fix this by passing "old" instead.
Products Associated with CVE-2026-80894
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 6d11543bf37abdf60b8e6022a62fccfb82a5fe2e and below adb87155b67f9759ff010c0a99559f5bffa45dcf is affected.
- Version fb21b1568adaa76af7a8c853f37c60fba8b28661 and below 564ac339c0f8bada4e77a57a92bab9d3df635e07 is affected.
- Version fb21b1568adaa76af7a8c853f37c60fba8b28661 and below 8eb077025279304268bd58657f0af3d388822b21 is affected.
- Version fb21b1568adaa76af7a8c853f37c60fba8b28661 and below ba5c0f28a26e7d9be1e0997f8920dd638e2782fd is affected.
- Version 1e0216b6a58c79b5ee91c78706d5f560e4d1f56f is affected.
- Version 4b23c4b991eb90cc7bca42e9f81142feedd4bb56 is affected.
- Version 6.12.24 and below 6.12.105 is affected.
- Version 6.13.12 and below 6.14 is affected.
- Version 6.14.3 and below 6.15 is affected.
- Version 6.15 is affected.
- Before 6.15 is unaffected.
- Version 6.12.105, <= 6.12.* is unaffected.
- Version 6.18.44, <= 6.18.* is unaffected.
- Version 7.1.8, <= 7.1.* is unaffected.
- Version 7.2, <= * is unaffected.