CVE-2026-89446

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-89446", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.704Z", "datePublished": "2026-09-11T19:43:13.431Z", "dateUpdated": "2026-10-19T08:46:55.828Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T08:46:55.828Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommufd: Release current IOAS on xa_store() failure\n\niommufd_take_all_iova_rwsem() takes an object reference and the\niova_rwsem write lock before storing the IOAS in the temporary ioas_list\nxarray.\n\nIf xa_store() fails, the current IOAS has not been inserted into\nioas_list yet. iommufd_release_all_iova_rwsem() only unwinds IOAS\nobjects already present in that xarray, so it cannot release the current\nIOAS.\n\nRelease the current IOAS rwsem and object reference before unwinding the\npreviously stored entries."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/iommu/iommufd/ioas.c"], "versions": [{"version": "051ae5aa73d782a8be2699a11e17c68f28b4e758", "lessThan": "4c33d00ad9a911e87ea222986f732ce072e3aa26", "status": "affected", "versionType": "git"}, {"version": "051ae5aa73d782a8be2699a11e17c68f28b4e758", "lessThan": "07b4fe1367f076886c1c47a19c70936138325087", "status": "affected", "versionType": "git"}, {"version": "051ae5aa73d782a8be2699a11e17c68f28b4e758", "lessThan": "4ac2ce123824d5f885c868fa1f9f4d463141a2ba", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/iommu/iommufd/ioas.c"], "versions": [{"version": "6.13", "status": "affected"}, {"version": "0", "lessThan": "6.13", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.50", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.4", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.18.50"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "7.2.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/4c33d00ad9a911e87ea222986f732ce072e3aa26"}, {"url": "https://git.kernel.org/stable/c/07b4fe1367f076886c1c47a19c70936138325087"}, {"url": "https://git.kernel.org/stable/c/4ac2ce123824d5f885c868fa1f9f4d463141a2ba"}], "title": "iommufd: Release current IOAS on xa_store() failure", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/iommu/iommufd/ioas.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "4c33d00ad9a911e87ea222986f732ce072e3aa26", "status": "affected", "version": "051ae5aa73d782a8be2699a11e17c68f28b4e758", "versionType": "git"}, {"lessThan": "07b4fe1367f076886c1c47a19c70936138325087", "status": "affected", "version": "051ae5aa73d782a8be2699a11e17c68f28b4e758", "versionType": "git"}, {"lessThan": "4ac2ce123824d5f885c868fa1f9f4d463141a2ba", "status": "affected", "version": "051ae5aa73d782a8be2699a11e17c68f28b4e758", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/iommu/iommufd/ioas.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.13"}, {"lessThan": "6.13", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.50", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommufd: Release current IOAS on xa_store() failure\n\niommufd_take_all_iova_rwsem() takes an object reference and the\niova_rwsem write lock before storing the IOAS in the temporary ioas_list\nxarray.\n\nIf xa_store() fails, the current IOAS has not been inserted into\nioas_list yet. iommufd_release_all_iova_rwsem() only unwinds IOAS\nobjects already present in that xarray, so it cannot release the current\nIOAS.\n\nRelease the current IOAS rwsem and object reference before unwinding the\npreviously stored entries."}], "id": "CVE-2026-89446", "lastModified": "2026-10-19T09:17:36.743", "metrics": {}, "published": "2026-09-11T20:19:25.110", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/07b4fe1367f076886c1c47a19c70936138325087"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4ac2ce123824d5f885c868fa1f9f4d463141a2ba"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4c33d00ad9a911e87ea222986f732ce072e3aa26"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Linux kernel iommufd: Resource leak due to improper IOAS release", "id": "2532091", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532091"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-772", "details": ["A flaw was found in the Linux kernel's iommufd component. When the system attempts to store an Input/Output Address Space (IOAS) object and the storage operation fails, the IOAS object's associated resources, such as its write lock and object reference, are not properly released. This oversight can lead to a resource leak, which a local attacker could potentially exploit to cause a Denial of Service (DoS) condition due to resource exhaustion."], "name": "CVE-2026-89446", "package_state": [{"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-11T19:43:13Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-89446\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-89446\nhttps://git.kernel.org/stable/c/07b4fe1367f076886c1c47a19c70936138325087\nhttps://git.kernel.org/stable/c/4ac2ce123824d5f885c868fa1f9f4d463141a2ba\nhttps://git.kernel.org/stable/c/4c33d00ad9a911e87ea222986f732ce072e3aa26"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[051ae5aa73d782a8be2699a11e17c68f28b4e758,4c33d00ad9a911e87ea222986f732ce072e3aa26)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[051ae5aa73d782a8be2699a11e17c68f28b4e758,07b4fe1367f076886c1c47a19c70936138325087)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[051ae5aa73d782a8be2699a11e17c68f28b4e758,4ac2ce123824d5f885c868fa1f9f4d463141a2ba)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.13"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.13)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.50,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.4,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-12T06:00:10.891823+00:00", "updated": "2026-09-21T01:30:08.763424+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}