← Back to the live CVE advisory feed

CVE-2026-80633: Linux

Severity

8.8 (HIGH)

Vendor

LINUX

Affected versions

8c5f9645c3893f0db679d9affe4fe4e665b990dd through before cc69d0332421fd2943b66dbe5e597bf4fd5af126; 8c5f9645c3893f0db679d9

Patch status

Patched

Published

2026-08-28T08:16:48.200

Modified

2026-08-29T07:16:47.320

Why it matters

High-severity vulnerability requiring prioritized review.

Recommended admin actions

• Review and patch based on exposure, asset criticality, and business impact.
• Compare installed versions against the affected version range in the advisory.

Technical summary

In the Linux kernel, the following vulnerability has been resolved: iommufd: Take dma_resv lock before dma_buf_unpin() in release path dma_buf_unpin() requires the caller to hold the exporter's dma_resv lock: void dma_buf_unpin(struct dma_buf_attachment *attach) { … dma_resv_assert_held(dmabuf->resv); … } iopt_release_pages() calls dma_buf_unpin() without taking that lock, so every iommufd_ioas_destroy()/iommufd_ioas_unmap() that releases the last reference on a DMABUF-backed iopt_pages triggers a WARN. This was hit while running tools/testing/selftests/iommu/iommufd: WARNING: drivers/dma-buf/dma-buf.c:1137 at dma_buf_unpin+0x62/0x70 RIP: 0010:dma_buf_unpin+0x62/0x70 Call Trace: dma_buf_unpin+0x62/0x70 iopt_release_pages+0xe4/0x190 iopt_unmap_iova_range+0x1c7/0x290 iopt_unmap_all+0x1a/0x30 iommufd_ioas_destroy+0x1d/0x50 iommufd_fops_release+0x93/0x150 __fput+0xfc/0x2c0 __x64_sys_close+0x3d/0x80 do_syscall_64+0x65/0x180 Take the dma_resv lock around dma_buf_unpin() in iopt_release_pages(), matching the iopt_map_dmabuf() convention. dma_buf_detach() acquires the reservation lock internally, so it must remain outside the locked region.

View the official NVD record for CVE-2026-80633

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.