CVE-2026-89996

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds

DMA_HEAP_IOCTL_ALLOC allocates a dma-buf and installs an fd into the

caller's fd table via dma_buf_fd() -> fd_install() before

dma_heap_ioctl() copies the result back to userspace. If the trailing

copy_to_user() fails, userspace never learns the fd number, but the

fd (and the underlying dma-buf reference) are already visible to

other threads in the same process and are leaked for the lifetime of

the process.

The obvious "close it on the failure path" fix is unsafe: once

fd_install() has run, another thread can already dup() the fd, send

it via SCM_RIGHTS, or close() it and let its number be reused, so a

subsequent close_fd() from the ioctl path can operate on an unrelated

file. This was pointed out by Christian König on v1 [1].

Restructure the allocation path so that fd_install() is the last,

unfailable step of a successful ioctl:

1. heap->ops-

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References