CVE-2026-89445

In the Linux kernel, the following vulnerability has been resolved:

iommufd: Fix UAF in selftest IOPF reporting

IOMMUFD selftest TRIGGER_IOPF borrows an attach handle from

group->pasid_array without synchronizing against PASID detach,

then a concurrent iommu_report_device_fault() can dereference

that borrowed handle's domain pointer after the detach erases

the handle and frees the backing struct iommufd_attach_handle.

TRIGGER_IOPF then dereferences the freed handle, causing a UAF.

Fix by adding a iopf_rwsem in mock_dev to follow the expected design

of a real driver. Hold its read side across the whole

iommu_report_device_fault() call, and its write side around every

path that attaches, detaches, or replaces a device domain.

This can block new reports and drains in-flight reports before an old

attach handle or the IOPF fault parameter can be removed.

Also take the write side while registering a mock device, since

it can invoke the mock driver's default-domain attach callback.