CVE-2026-90244 (GCVE-0-2026-90244)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:07 – Updated: 2026-09-18 17:54
VLAI
Title
iommu/dma: Restore locking around msi_page_list
Summary
In the Linux kernel, the following vulnerability has been resolved: iommu/dma: Restore locking around msi_page_list Unlike a group's default domain, which is always freshly allocated and privately owned (iommu_group_alloc_default_domain()), VFIO type1's legacy container merges any newly attached group into an existing domain whenever their iommu_ops and cache-coherency enforcement match. iommu_dma_get_msi_page() only asserts the caller's own group mutex is held (iommu_group_mutex_assert()). On an IOMMU that publishes IOMMU_RESV_SW_MSI, e.g. ARM SMMU, a VM with two such devices assigned through the legacy container can have their guest drivers probe and allocate MSIs in parallel; each host-side VFIO_DEVICE_SET_IRQS lands on a different device fd and group mutex, but both devices' domains are the same merged domain, so both can enter iommu_dma_get_msi_page() concurrently and corrupt msi_page_list. commit 288683c92b1a ("iommu: Make iommu_dma_prepare_msi() into a generic operation") dropped the prior msi_prepare_lock on the reasoning that "each iommu_domain is unique to a group," which holds for default domains but not this VFIO type1 case. Restore the static lock, since it's only guarding a corner case and will likely never be contended. iommufd avoids the equivalent problem by having its own callers (iommufd_sw_map_msi()) take a ctx-wide sw_msi_lock before ever reaching the shared list. VFIO type1 can't mirror that since it dispatches to iommu_dma_sw_msi() which is outside VFIO's jurisdiction.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 288683c92b1abc32277c83819bea287af614d239 , < e3c53e9173a47d5ce1fae020f2c6b1fb3c1123c2 (git)
Affected: 288683c92b1abc32277c83819bea287af614d239 , < 2af1e99ec14d226d66ceb9f16c663ee2568e6676 (git)
Affected: 288683c92b1abc32277c83819bea287af614d239 , < 5a9e89ea34e0e34ac5d7e949042d665533549e40 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.15
Unaffected: 0 , < 6.15 (semver)
Unaffected: 6.18.52 , ≤ 6.18.* (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/dma-iommu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e3c53e9173a47d5ce1fae020f2c6b1fb3c1123c2",
              "status": "affected",
              "version": "288683c92b1abc32277c83819bea287af614d239",
              "versionType": "git"
            },
            {
              "lessThan": "2af1e99ec14d226d66ceb9f16c663ee2568e6676",
              "status": "affected",
              "version": "288683c92b1abc32277c83819bea287af614d239",
              "versionType": "git"
            },
            {
              "lessThan": "5a9e89ea34e0e34ac5d7e949042d665533549e40",
              "status": "affected",
              "version": "288683c92b1abc32277c83819bea287af614d239",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/dma-iommu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "lessThan": "6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/dma: Restore locking around msi_page_list\n\nUnlike a group\u0027s default domain, which is always freshly allocated\nand privately owned (iommu_group_alloc_default_domain()), VFIO type1\u0027s\nlegacy container merges any newly attached group into an existing\ndomain whenever their iommu_ops and cache-coherency enforcement match.\n\niommu_dma_get_msi_page() only asserts the caller\u0027s own group mutex is\nheld (iommu_group_mutex_assert()). On an IOMMU that publishes\nIOMMU_RESV_SW_MSI, e.g. ARM SMMU, a VM with two such devices assigned\nthrough the legacy container can have their guest drivers probe and\nallocate MSIs in parallel; each host-side VFIO_DEVICE_SET_IRQS lands\non a different device fd and group mutex, but both devices\u0027 domains\nare the same merged domain, so both can enter\niommu_dma_get_msi_page() concurrently and corrupt msi_page_list.\n\ncommit 288683c92b1a (\"iommu: Make iommu_dma_prepare_msi() into a\ngeneric operation\") dropped the prior msi_prepare_lock on the\nreasoning that \"each iommu_domain is unique to a group,\" which holds\nfor default domains but not this VFIO type1 case. Restore the static\nlock, since it\u0027s only guarding a corner case and will likely never\nbe contended.\n\niommufd avoids the equivalent problem by having its own callers\n(iommufd_sw_map_msi()) take a ctx-wide sw_msi_lock before ever\nreaching the shared list. VFIO type1 can\u0027t mirror that since it\ndispatches to iommu_dma_sw_msi() which is outside VFIO\u0027s jurisdiction."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The race is entered only via ioctl(VFIO_DEVICE_SET_IRQS) on a local vfio-pci fd: vfio_pci_core_ioctl \u2192 vfio_pci_ioctl_set_irqs \u2192 vfio_pci_set_msi_trigger \u2192 vfio_msi_enable \u2192 pci_alloc_irq_vectors \u2192 its_irq_domain_alloc \u2192 iommu_dma_prepare_msi \u2192 iommu_dma_get_msi_page. No received packet or protocol message carries the trigger.\nAC:L - The attacker issues concurrent VFIO_DEVICE_SET_IRQS on two device fds whose groups vfio_iommu_type1_attach_group already merged onto one domain; iommu_dma_prepare_msi takes only each device\u0027s own group-\u003emutex, so both threads run iommu_dma_get_msi_page() on the shared msi_page_list. The attacker owns both sides of the race.\nPR:L - vfio_pci_ioctl_set_irqs() and vfio_group_fops_open() have no capable() check on the IOMMU-backed path; CAP_SYS_RAWIO gates only VFIO_NO_IOMMU. An unprivileged qemu/kvm-group or DPDK user with two assigned /dev/vfio nodes can attach them to a type1 container and call SET_IRQS.\nUI:N - The attacker attaches its own groups with vfio_iommu_type1_attach_group and fires the concurrent SET_IRQS ioctls on fds it already holds; no other user must mount, open, or otherwise act.\nS:U - The race corrupts the host kernel\u0027s msi_page_list of iommu_dma_msi_page objects. iommu_map() still maps only the irqchip doorbell from its-\u003eget_msi_base() into the IOMMU_RESV_SW_MSI window vfio_iommu_has_sw_msi() reserved; that does not install extra host-RAM translations or bypass the DMA/VM isolation boundary.\nC:H - Concurrent list_for_each_entry() versus unlocked list_add() on msi_page_list can follow a torn next pointer into a freed iommu_dma_msi_page, a use-after-free read of phys/iova and neighboring slab.\nI:H - Unlocked list_add() of iommu_dma_msi_page nodes overwrites kernel list next/prev, and the unlocked msi_cookie-\u003emsi_iova bump in iommu_dma_alloc_iova() can alias IOVAs; a sprayable UAF of that object is an arbitrary-write and control-flow primitive.\nA:H - A corrupted msi_page_list walk or list_add in iommu_dma_get_msi_page() dereferences invalid list pointers and oopses or panics the host kernel even if the UAF is not fully weaponized."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T17:54:08.500Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e3c53e9173a47d5ce1fae020f2c6b1fb3c1123c2"
        },
        {
          "url": "https://git.kernel.org/stable/c/2af1e99ec14d226d66ceb9f16c663ee2568e6676"
        },
        {
          "url": "https://git.kernel.org/stable/c/5a9e89ea34e0e34ac5d7e949042d665533549e40"
        }
      ],
      "title": "iommu/dma: Restore locking around msi_page_list",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90244",
    "datePublished": "2026-09-17T16:07:47.121Z",
    "dateReserved": "2026-09-11T19:38:34.795Z",
    "dateUpdated": "2026-09-18T17:54:08.500Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-90244",
      "date": "2026-09-25",
      "epss": "0.00173",
      "percentile": "0.05972"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/iommu/dma-iommu.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "e3c53e9173a47d5ce1fae020f2c6b1fb3c1123c2",
                    "status": "affected",
                    "version": "288683c92b1abc32277c83819bea287af614d239",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2af1e99ec14d226d66ceb9f16c663ee2568e6676",
                    "status": "affected",
                    "version": "288683c92b1abc32277c83819bea287af614d239",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5a9e89ea34e0e34ac5d7e949042d665533549e40",
                    "status": "affected",
                    "version": "288683c92b1abc32277c83819bea287af614d239",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/iommu/dma-iommu.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.15"
                  },
                  {
                    "lessThan": "6.15",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.52",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/dma: Restore locking around msi_page_list\n\nUnlike a group\u0027s default domain, which is always freshly allocated\nand privately owned (iommu_group_alloc_default_domain()), VFIO type1\u0027s\nlegacy container merges any newly attached group into an existing\ndomain whenever their iommu_ops and cache-coherency enforcement match.\n\niommu_dma_get_msi_page() only asserts the caller\u0027s own group mutex is\nheld (iommu_group_mutex_assert()). On an IOMMU that publishes\nIOMMU_RESV_SW_MSI, e.g. ARM SMMU, a VM with two such devices assigned\nthrough the legacy container can have their guest drivers probe and\nallocate MSIs in parallel; each host-side VFIO_DEVICE_SET_IRQS lands\non a different device fd and group mutex, but both devices\u0027 domains\nare the same merged domain, so both can enter\niommu_dma_get_msi_page() concurrently and corrupt msi_page_list.\n\ncommit 288683c92b1a (\"iommu: Make iommu_dma_prepare_msi() into a\ngeneric operation\") dropped the prior msi_prepare_lock on the\nreasoning that \"each iommu_domain is unique to a group,\" which holds\nfor default domains but not this VFIO type1 case. Restore the static\nlock, since it\u0027s only guarding a corner case and will likely never\nbe contended.\n\niommufd avoids the equivalent problem by having its own callers\n(iommufd_sw_map_msi()) take a ctx-wide sw_msi_lock before ever\nreaching the shared list. VFIO type1 can\u0027t mirror that since it\ndispatches to iommu_dma_sw_msi() which is outside VFIO\u0027s jurisdiction."
          }
        ],
        "id": "CVE-2026-90244",
        "lastModified": "2026-09-18T18:17:50.720",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-17T17:17:20.400",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2af1e99ec14d226d66ceb9f16c663ee2568e6676"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5a9e89ea34e0e34ac5d7e949042d665533549e40"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e3c53e9173a47d5ce1fae020f2c6b1fb3c1123c2"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.