CVE-2026-52952: Linux Kernel IOMMU Use-After-Free in Domain Attachment

Technical summary

The vulnerability exists in __iommu_group_set_domain_internal() within the Linux kernel's IOMMU subsystem. During device recovery (indicated by recovery_cnt > 0), the function rejects all concurrent domain attachments to prevent race conditions in multi-device groups with shared Request IDs (RID) due to PCI DMA alias quirks. However, this blanket rejection blocks critical teardown and cleanup paths that must succeed, including __iommu_group_set_core_domain() and __iommu_release_dma_ownership(). These nofail callers need to update group->domain pointers even during recovery, but are incorrectly rejected, leaving stale references to freed domain structures. When pci_dev_reset_iommu_done() attempts to re-attach the old group->domain reference, a use-after-free (UAF) condition occurs. The fix honors the IOMMU_SET_DOMAIN_MUST_SUCCEED flag to permit recovery-path callers through the recovery_cnt fence while adding a gdev->blocked check in the per-device loop to prevent other concurrent detachments.

Business impact

Organizations running Linux systems with IOMMU-capable hardware (common in servers, data centers, and virtualized environments) face kernel stability and availability risks. Exploitation can cause unplanned kernel panics, service interruptions, and potential guest VM isolation breaches in virtualized deployments. In high-availability environments, frequent crashes degrade system reliability and increase operational overhead. While privilege escalation to arbitrary code execution is possible, the primary business impact is denial of service and reduced trust in system stability.

Affected systems

This vulnerability affects the Linux kernel across all versions that contain the affected IOMMU code path. Systems with IOMMU hardware support enabled (particularly those using AMD IOMMU or Intel VT-d) and handling device hotplug, reset, or VM device assignment operations are at greatest risk. Cloud providers, virtualization platforms, and enterprises using PCIe device passthrough or live migration features should prioritize assessment. The vulnerability requires local access (privilege level: low user), so remote exploitation is not possible.

Exploitability

Exploitation requires local access with unprivileged user privileges (PR:L in the CVSS vector), making it a privilege-escalation vector rather than a remote threat. An attacker must trigger device reset or domain attachment operations, which can occur through legitimate operations like device unbind/rebind, VM device reassignment, or explicit reset commands. The timing-dependent nature of the race condition may require repeated attempts, but the condition is triggerable without needing root at the initial access point. The attack surface is moderately broad on systems supporting dynamic IOMMU domain management.

Remediation

Apply the Linux kernel patch that modifies __iommu_group_set_domain_internal() to respect the IOMMU_SET_DOMAIN_MUST_SUCCEED flag and bypass the recovery_cnt fence for critical nofail callers. The patch adds a gdev->blocked check to the device iteration loop as an alternative guard against concurrent per-device detachment. Verify the patch version against your vendor or Linux distribution's security advisories, as different vendors backport fixes to different kernel versions. Systems unable to patch immediately should disable IOMMU device hotplug and reset operations if operationally feasible, though this may limit functionality.

Patch guidance

Consult your Linux distribution's security advisory for the specific kernel version and patch release that addresses CVE-2026-52952. Upstream patches are typically available in linux-next or stable kernel branches following the published date. Priority should be given to production systems running virtualization hypervisors (KVM, Xen) or systems performing PCIe device assignment. Regression testing post-patch should focus on IOMMU domain attachment/detachment cycles and device reset scenarios to ensure the fix does not introduce new issues in your workload profile.

Detection guidance

Monitor kernel logs for WARN_ON messages originating from __iommu_group_set_domain_nofail() or use-after-free (UAF) detection mechanisms like KASAN (Kernel Address Sanitizer). In production systems without KASAN, look for unscheduled kernel panics with stack traces mentioning IOMMU group management functions, particularly during device reset or VM device hotplug events. Correlate system reboots with device lifecycle events (device bind/unbind operations, VM migrations, or explicit device resets). Systems with audit logging enabled may record BPF or LSM hooks if they instrument memory management; review for unexpected domain structure accesses.

Why prioritize this

The 8.8 HIGH CVSS score reflects the vulnerability's combination of local privilege escalation capability (leading to kernel code execution), broad impact scope across multiple security properties (confidentiality, integrity, availability via the S:C vector), and low attack complexity. Although it requires local access, the ability to crash the kernel or potentially achieve privilege escalation through UAF exploitation makes it a priority for Linux-based infrastructure. The absence from the CISA KEV catalog does not diminish its severity; it indicates limited active exploitation in the wild as of the publication date, which should not delay patching efforts.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) is derived from: Attack Vector: Local (AV:L) — no network reachability, but not purely local-only as IOMMU events can be triggered through unprivileged user operations; Attack Complexity: Low (AC:L) — the race condition is reproducible without exotic conditions; Privileges Required: Low (PR:L) — unprivileged user can trigger IOMMU operations; User Interaction: None (UI:N) — no user action required beyond issuing commands; Scope: Changed (S:C) — affects other security domains (kernel memory, other processes); Confidentiality, Integrity, Availability: All High (C:H/I:H/A:H) — UAF can lead to information disclosure, code execution, or crash. The score appropriately reflects the severity for infrastructure systems but is somewhat mitigated by the local-only attack vector.

Frequently asked questions