CVE-2026-80894

CVE CVE-2026-80894EUVD EUVD-2026-71644Published 2026-09-04T17:11:10.000Z

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace iommufd_hwpt_replace_device() calls: iommufd_auto_response_faults(hwpt, old_handle); passing the *new* hwpt together with the handle of the device's *old* domain. This should be a parameter mismatch: 1. Semantically, iommufd_auto_response_faults(x, handle) scans x->fault's deliver list and response xarray for groups matching "handle". A group is queued under the hwpt that was attached at fault-delivery time. old_handle is fetched *before* the domain switch, so its group lives on old->fault, not on the new hwpt->fault. 2. Historically, the first argument was "old". The routine was introduced by commit b7d8833677ba ("iommufd: Fault-capable hwpt attach/detach/replace") as __fault_domain_replace_dev() in fault.c, correctly calling iommufd_auto_response_faults(old, curr). Commit fb21b1568ada ("iommufd: Make attach_handle generic than fault specific") moved this into iommufd_hwpt_replace_device() in device.c and swapped it to "hwpt". This should be a refactor regression, not an intentional change. Fix this by passing "old" instead.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

Linux — Linux 6.13.12 <6.14; patch: 7.1.8; fb21b1568adaa76af7a8c853f37c60fba8b28661 <564ac339c0f8bada4e77a57a92bab9d3df635e07; 4b23c4b991eb90cc7bca42e9f81142feedd4bb56; fb21b1568adaa76af7a8c853f37c60fba8b28661 <8eb077025279304268bd58657f0af3d388822b21; 6.15; patch: 6.18.44; patch: 7.2; fb21b1568adaa76af7a8c853f37c60fba8b28661 <ba5c0f28a26e7d9be1e0997f8920dd638e2782fd; patch: 0; 6d11543bf37abdf60b8e6022a62fccfb82a5fe2e <adb87155b67f9759ff010c0a99559f5bffa45dcf; patch: 6.12.105; 6.12.24 <6.12.105; 6.14.3 <6.15; 1e0216b6a58c79b5ee91c78706d5f560e4d1f56f

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

Linux — Linux

Does this concern one of your customers?

This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.

Try it for 28 days

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.