Linux Kernel up to 7.1.4 iommufd dma-buf.c iopt_release_pages assertion

Summaryinfo

A vulnerability identified as problematic has been detected in Linux Kernel up to 7.1.4. Affected by this issue is the function iopt_release_pages of the file drivers/dma-buf/dma-buf.c of the component iommufd. Performing a manipulation results in assertion. This vulnerability was named CVE-2026-80633. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability was found in Linux Kernel up to 7.1.4. It has been classified as problematic. This affects the function iopt_release_pages of the file drivers/dma-buf/dma-buf.c of the component iommufd. The manipulation with an unknown input leads to a assertion vulnerability. CWE is classifying the issue as CWE-617. The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary. This is going to have an impact on integrity, and availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: iommufd: Take dma_resv lock before dma_buf_unpin() in release path dma_buf_unpin() requires the caller to hold the exporter's dma_resv lock: void dma_buf_unpin(struct dma_buf_attachment *attach) { ... dma_resv_assert_held(dmabuf->resv); ... } iopt_release_pages() calls dma_buf_unpin() without taking that lock, so every iommufd_ioas_destroy()/iommufd_ioas_unmap() that releases the last reference on a DMABUF-backed iopt_pages triggers a WARN. This was hit while running tools/testing/selftests/iommu/iommufd: WARNING: drivers/dma-buf/dma-buf.c:1137 at dma_buf_unpin+0x62/0x70 RIP: 0010:dma_buf_unpin+0x62/0x70 Call Trace: <TASK> dma_buf_unpin+0x62/0x70 iopt_release_pages+0xe4/0x190 iopt_unmap_iova_range+0x1c7/0x290 iopt_unmap_all+0x1a/0x30 iommufd_ioas_destroy+0x1d/0x50 iommufd_fops_release+0x93/0x150 __fput+0xfc/0x2c0 __x64_sys_close+0x3d/0x80 do_syscall_64+0x65/0x180 </TASK> Take the dma_resv lock around dma_buf_unpin() in iopt_release_pages(), matching the iopt_map_dmabuf() convention. dma_buf_detach() acquires the reservation lock internally, so it must remain outside the locked region.

The advisory is shared at git.kernel.org. This vulnerability is uniquely identified as CVE-2026-80633 since 08/26/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/28/2026).

Upgrading to version 7.1.5 eliminates this vulnerability. Applying the patch cc69d0332421fd2943b66dbe5e597bf4fd5af126/e745cd2c749e557c14a15ac931761c3f58c24489 is able to eliminate this problem.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.1.0
• 7.1.1
• 7.1.2
• 7.1.3
• 7.1.4

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion