SB2026090556 - Function Call with Incorrectly Specified Arguments in Linux kernel iommu iommufd driver

Description

This security bulletin contains information about 1 vulnerability.

1) Function Call with Incorrectly Specified Arguments (CVE-ID: CVE-2026-80894)

CWE-ID: CWE-628 - Function Call with Incorrectly Specified Arguments

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to prevent automatic responses to IOMMU faults.

The vulnerability exists due to incorrectly specified function arguments in iommufd_hwpt_replace_device() when replacing a device hardware page table. A local user can replace a device hardware page table while faults are pending to prevent automatic responses to IOMMU faults.

The affected fault group is associated with the hardware page table that was attached when fault delivery occurred.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/564ac339c0f8bada4e77a57a92bab9d3df635e07
• https://git.kernel.org/stable/c/8eb077025279304268bd58657f0af3d388822b21
• https://git.kernel.org/stable/c/adb87155b67f9759ff010c0a99559f5bffa45dcf
• https://git.kernel.org/stable/c/ba5c0f28a26e7d9be1e0997f8920dd638e2782fd