Linux Kernel up to 7.2.5 IOMMU VT-d intel_iommu_attach_device reference count

Summaryinfo

A vulnerability, which was classified as problematic, was found in Linux Kernel up to 7.2.5. The affected element is the function intel_iommu_attach_device of the component IOMMU VT-d. Executing a manipulation can lead to reference count. This vulnerability is handled as CVE-2026-90242. It is possible to launch the attack on the local host. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability has been found in Linux Kernel up to 7.2.5 and classified as problematic. This vulnerability affects the function intel_iommu_attach_device of the component IOMMU VT-d. The manipulation with an unknown input leads to a reference count vulnerability. The CWE definition for the vulnerability is CWE-911. The product uses a reference count to manage a resource, but it does not update or incorrectly updates the reference count. As an impact it is known to affect availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix iopf_refcount leak on RID domain replacement intel_iommu_attach_device() enables IOPF for the new domain but never disables it for the old one. device_block_translation(), called at the start of the function, tears down translation but does not touch any IOPF state; blocking_domain_attach_dev() has to call iopf_for_domain_remove() explicitly before invoking it for exactly this reason. identity_domain_attach_dev() has the same problem. Its comment claims that no PRI handling is needed because the device has been put in the blocking state, but the blocking state and the IOPF reference count are independent of each other. As a result, replacing a domain that has an iopf_handler with another domain at RID level leaks a reference in info->iopf_refcount. The count never drops back to zero, so iopf_queue_remove_device() is never called and iommu_disable_pci_pri() triggers its WARN_ON(info->iopf_refcount) when the device is released. The PASID paths already handle this correctly by way of iopf_for_domain_replace(); convert the two RID paths to do the same. Using the replace helper rather than a bare remove keeps the enable before the disable, so the reference count does not transiently reach zero and evict the device from the IOPF queue.

The advisory is available at git.kernel.org. This vulnerability was named CVE-2026-90242 since 09/11/2026. The exploitation appears to be easy. Local access is required to approach this attack. The exploitation needs additional levels of successful authentication. Technical details are known, but there is no available exploit.

Upgrading to version 7.2.6 or 7.3-rc1 eliminates this vulnerability. Applying the patch 143cd37ce76527ddd6f6dbac4a89bde31fb8b0dc/236dd58fabd2e951b940a6ad88b81147899ed311 is able to eliminate this problem. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.2.0
• 7.2.1
• 7.2.2
• 7.2.3
• 7.2.4
• 7.2.5

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion