CVE-2026-89452 iommu/msm: Unwind probe state on registration failure
A use-after-free vulnerability in the Linux kernel MSM IOMMU driver allows attackers to cause a denial of service or potentially execute code via dangling list entries.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89452?
CVE-2026-89452 is a high-severity use after free vulnerability in Linux, published on 11 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
iommu/msm: Unwind probe state on registration failure
msm_iommu_probe() adds its devm-managed IOMMU object to qcom_iommu_devices before adding the IOMMU sysfs device and registering it with the IOMMU core.
If iommu_device_sysfs_add() fails, probe returns with the object still on qcom_iommu_devices. The driver core then releases the devm allocation, leaving a dangling list entry that later list walks may dereference.
If iommu_device_register() fails, the same dangling list entry remains and the sysfs device is left registered as well.
Unwind the sysfs device and global list entry in reverse setup order on the corresponding failure paths.
Which versions are affected by CVE-2026-89452?
How do I fix CVE-2026-89452?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-89452 being exploited?
There is no known exploitation of CVE-2026-89452 in the wild and no public exploit code.
Sources
Also known as AZL-100817, BELL-CVE-2026-89452, DEBIAN-CVE-2026-89452, GHSA-g6rr-fv4f-cc2j, UBUNTU-CVE-2026-89452.