CVE-2026-89453

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Put PCI device after handling PPR faults iommu_call_iopf_notifier() looks up the requester with pci_get_domain_bus_and_slot(), which returns a PCI device with its reference count incremented. Neither the successful iommu_report_device_fault() path nor the abort path drops that reference, so every handled PPR request leaks a PCI device reference. This is the same ownership rule that was fixed for the old iommu_v2 ppr_notifier() path by commit 6cf0981c2233 ("iommu/amd: Fix pci device refcount leak in ppr_notifier()"), but iommu_call_iopf_notifier() was added later as a separate PPR/IOPF notifier path. Drop the PCI device reference after handling the PPR entry.

CVSS

No CVSS.

References

Link	Resource
https://git.kernel.org/stable/c/1de4443f85e4405af00153cdf8ba73ff12a65036
https://git.kernel.org/stable/c/af3b69b16383fbc8fe5f61b5b0150d2e41ede71f
https://git.kernel.org/stable/c/cfc5c1b2caa176dfd40b873a6ff07b11da34cc3e
https://git.kernel.org/stable/c/d1470e16c1977e6c94fadf6048deafaa4d150fec

Configurations

No configuration.

History

No history.

Information

Published : 2026-09-11 20:19

Updated : 2026-09-11 20:19

NVD link : CVE-2026-89453

Mitre link : CVE-2026-89453

CVE.ORG link : CVE-2026-89453

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2026-89453", "cveTags": [], "metrics": {}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "978d626b8f1a239acc635323d731c77eae54eb61", "lessThan": "1de4443f85e4405af00153cdf8ba73ff12a65036", "versionType": "git"}, {"status": "affected", "version": "978d626b8f1a239acc635323d731c77eae54eb61", "lessThan": "cfc5c1b2caa176dfd40b873a6ff07b11da34cc3e", "versionType": "git"}, {"status": "affected", "version": "978d626b8f1a239acc635323d731c77eae54eb61", "lessThan": "d1470e16c1977e6c94fadf6048deafaa4d150fec", "versionType": "git"}, {"status": "affected", "version": "978d626b8f1a239acc635323d731c77eae54eb61", "lessThan": "af3b69b16383fbc8fe5f61b5b0150d2e41ede71f", "versionType": "git"}], "programFiles": ["drivers/iommu/amd/ppr.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.10"}, {"status": "unaffected", "version": "0", "lessThan": "6.10", "versionType": "semver"}, {"status": "unaffected", "version": "6.12.109", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.50", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.2.4", "versionType": "semver", "lessThanOrEqual": "7.2.*"}, {"status": "unaffected", "version": "7.3-rc1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/iommu/amd/ppr.c"], "defaultStatus": "affected"}]}], "published": "2026-09-11T20:19:25.967", "references": [{"url": "https://git.kernel.org/stable/c/1de4443f85e4405af00153cdf8ba73ff12a65036", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/af3b69b16383fbc8fe5f61b5b0150d2e41ede71f", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/cfc5c1b2caa176dfd40b873a6ff07b11da34cc3e", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/d1470e16c1977e6c94fadf6048deafaa4d150fec", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Received", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/amd: Put PCI device after handling PPR faults\n\niommu_call_iopf_notifier() looks up the requester with\npci_get_domain_bus_and_slot(), which returns a PCI device with its\nreference count incremented.\n\nNeither the successful iommu_report_device_fault() path nor the abort\npath drops that reference, so every handled PPR request leaks a PCI\ndevice reference.\n\nThis is the same ownership rule that was fixed for the old iommu_v2\nppr_notifier() path by commit 6cf0981c2233 (\"iommu/amd: Fix pci device\nrefcount leak in ppr_notifier()\"), but iommu_call_iopf_notifier() was\nadded later as a separate PPR/IOPF notifier path.\n\nDrop the PCI device reference after handling the PPR entry."}], "lastModified": "2026-09-11T20:19:25.967", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}