CVE-2026-80633 in Linux
Summary
by MITRE • 08/28/2026
In the Linux kernel, the following vulnerability has been resolved:
iommufd: Take dma_resv lock before dma_buf_unpin() in release path
dma_buf_unpin() requires the caller to hold the exporter's dma_resv lock:
void dma_buf_unpin(struct dma_buf_attachment *attach) {
... dma_resv_assert_held(dmabuf->resv); ... }
iopt_release_pages() calls dma_buf_unpin() without taking that lock, so every iommufd_ioas_destroy()/iommufd_ioas_unmap() that releases the last reference on a DMABUF-backed iopt_pages triggers a WARN. This was hit while running tools/testing/selftests/iommu/iommufd:
WARNING: drivers/dma-buf/dma-buf.c:1137 at dma_buf_unpin+0x62/0x70 RIP: 0010:dma_buf_unpin+0x62/0x70 Call Trace: <TASK> dma_buf_unpin+0x62/0x70 iopt_release_pages+0xe4/0x190 iopt_unmap_iova_range+0x1c7/0x290 iopt_unmap_all+0x1a/0x30 iommufd_ioas_destroy+0x1d/0x50 iommufd_fops_release+0x93/0x150 __fput+0xfc/0x2c0 __x64_sys_close+0x3d/0x80 do_syscall_64+0x65/0x180 </TASK>
Take the dma_resv lock around dma_buf_unpin() in iopt_release_pages(), matching the iopt_map_dmabuf() convention. dma_buf_detach() acquires the reservation lock internally, so it must remain outside the locked region.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/28/2026
The Linux kernel's IOMMUFD subsystem contains a concurrency synchronization flaw within its memory management path for DMA buffer objects. Specifically, the function iopt_release_pages invokes dma_buf_unpin without acquiring the necessary exporter reservation lock, known as dma_resv. This oversight violates the locking protocol enforced by the dma-buf framework, which mandates that callers must hold the dma_resv lock when calling unpin operations to ensure data integrity and prevent race conditions during buffer state transitions. The vulnerability manifests primarily in the release path of iommufd_ioas_destroy or iommufd_ioas_unmap functions when they are releasing the final reference count on a DMABUF-backed io page table structure.
When this locking violation occurs, the kernel detects the missing lock context and triggers a warning assertion within dma_buf.c at line 1137. This results in a stack trace that propagates through iopt_release_pages to iopt_unmap_iova_range and ultimately to the file operation release handler. While the immediate symptom is a kernel warning rather than a direct crash, such warnings indicate serious synchronization issues that can lead to undefined behavior under concurrent access scenarios. The issue was identified during execution of self-tests in tools/testing/selftests/iommu/iommufd, highlighting its relevance to standard validation suites for IOMMU functionality.
From a security and stability perspective, this vulnerability aligns with CWE-667, which describes improper locking mechanisms that can lead to race conditions or deadlocks. In the context of ATT&CK techniques, while not directly exploitable for privilege escalation in most cases due to the nature of kernel warnings, it represents an Improper Resource Shutdown or Release (CWE-459) variant where resource management protocols are bypassed. The lack of proper locking could theoretically allow concurrent modifications to DMA buffer states, potentially leading to use-after-free scenarios if other subsystems assume exclusive access during unpin operations.
The remediation involves modifying the iopt_release_pages function to acquire the dma_resv lock before invoking dma_buf_unpin. This change aligns the release path with the conventions established in iopt_map_dmabuf, ensuring consistent locking behavior across both mapping and unmapping operations. It is critical that developers note that dma_buf_detach already acquires its own reservation lock internally; therefore, it must remain outside the locked region to avoid double-locking issues or deadlocks. This patch ensures compliance with kernel synchronization standards and prevents spurious warnings during normal IOMMU device teardown processes.