Riskcovery

CVE-2026-80687

iommufd/viommu: Release the igroup lock on the vdevice_size error path

State
Published
Severity
Not scored
Published
Aug 28, 2026
Updated
Aug 28, 2026
Reserved
Aug 26, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

iommufd/viommu: Release the igroup lock on the vdevice_size error path

iommufd_vdevice_alloc_ioctl() takes idev->igroup->lock, then validates the driver's vdevice_size against the core structure size with a WARN_ON_ONCE. On failure that guard jumps to out_put_idev, below out_unlock_igroup, so it skips the mutex_unlock(), leaving the igroup lock held and deadlocking the next vDEVICE operation on that group.

Jump to out_unlock_igroup instead.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • ed42eee797ff3dc889ade63c1dd7c4f430699e23 to before 294b464b2be7e57872864cb6936e1d9c7294f89dAffected
  • ed42eee797ff3dc889ade63c1dd7c4f430699e23 to before ca9e49e1c8931a4e6e743a1f1d2e7f977f774b86Affected
  • ed42eee797ff3dc889ade63c1dd7c4f430699e23 to before 339bd11591593ab7ce88136ab7fd01ef3813b724Affected
LinuxLinux
  • 6.17Affected
  • before 6.17Not affected
  • 6.18.44 through 6.18.*Not affected
  • 7.1.8 through 7.1.*Not affected
  • 7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.