CVE-2026-80817

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

iommu/iommufd: Fix NULL pointer deref in iommufd_ioas_change_process when racing with iopt_map_file_pages

iommufd_ioas_change_process() iterates every IOAS area while only

holding every IOAS iova_rwsem, so it assumes every area has a non-NULL

pages pointer. That assumption can be false when it runs concurrently

with iopt_map_file_pages().

iopt_map_pages() executes in two phases. It first creates the area and

inserts it into the interval tree under iova_rwsem, with area->pages

still NULL. It then drops iova_rwsem and later fills area->pages

under domains_rwsem. This leaves a window between area creation and

area->pages fill where a concurrent iommufd_ioas_change_process()

can observe the area and dereference a NULL area->pages pointer,

leading to a NULL pointer dereference:

BUG: kernel NULL pointer dereference, address: 00000000000000c0

#PF: supervisor read access in kernel mode

#PF: error_code(0x0000) - not-present

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References