FKIE_CVE-2026-90242

Vulnerability from fkie_nvd - Published: 2026-09-17 17:17 - Updated: 2026-10-19 09:19
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix iopf_refcount leak on RID domain replacement intel_iommu_attach_device() enables IOPF for the new domain but never disables it for the old one. device_block_translation(), called at the start of the function, tears down translation but does not touch any IOPF state; blocking_domain_attach_dev() has to call iopf_for_domain_remove() explicitly before invoking it for exactly this reason. identity_domain_attach_dev() has the same problem. Its comment claims that no PRI handling is needed because the device has been put in the blocking state, but the blocking state and the IOPF reference count are independent of each other. As a result, replacing a domain that has an iopf_handler with another domain at RID level leaks a reference in info->iopf_refcount. The count never drops back to zero, so iopf_queue_remove_device() is never called and iommu_disable_pci_pri() triggers its WARN_ON(info->iopf_refcount) when the device is released. The PASID paths already handle this correctly by way of iopf_for_domain_replace(); convert the two RID paths to do the same. Using the replace helper rather than a bare remove keeps the enable before the disable, so the reference count does not transiently reach zero and evict the device from the IOPF queue.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/143cd37ce76527ddd6f6dbac4a89bde31fb8b0dc
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/236dd58fabd2e951b940a6ad88b81147899ed311
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/243bf1e45e40be4705aae17c5044bf83df5f4a92
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/intel/iommu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "243bf1e45e40be4705aae17c5044bf83df5f4a92",
              "status": "affected",
              "version": "17fce9d2336d952b95474248303e5e7d9777f2e0",
              "versionType": "git"
            },
            {
              "lessThan": "143cd37ce76527ddd6f6dbac4a89bde31fb8b0dc",
              "status": "affected",
              "version": "17fce9d2336d952b95474248303e5e7d9777f2e0",
              "versionType": "git"
            },
            {
              "lessThan": "236dd58fabd2e951b940a6ad88b81147899ed311",
              "status": "affected",
              "version": "17fce9d2336d952b95474248303e5e7d9777f2e0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/intel/iommu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "lessThan": "6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.57",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: Fix iopf_refcount leak on RID domain replacement\n\nintel_iommu_attach_device() enables IOPF for the new domain but never\ndisables it for the old one.  device_block_translation(), called at the\nstart of the function, tears down translation but does not touch any IOPF\nstate; blocking_domain_attach_dev() has to call iopf_for_domain_remove()\nexplicitly before invoking it for exactly this reason.\n\nidentity_domain_attach_dev() has the same problem.  Its comment claims\nthat no PRI handling is needed because the device has been put in the\nblocking state, but the blocking state and the IOPF reference count are\nindependent of each other.\n\nAs a result, replacing a domain that has an iopf_handler with another\ndomain at RID level leaks a reference in info-\u003eiopf_refcount.  The count\nnever drops back to zero, so iopf_queue_remove_device() is never called\nand iommu_disable_pci_pri() triggers its WARN_ON(info-\u003eiopf_refcount)\nwhen the device is released.\n\nThe PASID paths already handle this correctly by way of\niopf_for_domain_replace(); convert the two RID paths to do the same.\nUsing the replace helper rather than a bare remove keeps the enable\nbefore the disable, so the reference count does not transiently reach\nzero and evict the device from the IOPF queue."
    }
  ],
  "id": "CVE-2026-90242",
  "lastModified": "2026-10-19T09:19:14.683",
  "metrics": {},
  "published": "2026-09-17T17:17:20.190",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/143cd37ce76527ddd6f6dbac4a89bde31fb8b0dc"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/236dd58fabd2e951b940a6ad88b81147899ed311"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/243bf1e45e40be4705aae17c5044bf83df5f4a92"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.