CVE-2024-26709

What it actually does

Missing iommu_group_put() call in spapr_tce_platform_iommu_attach_dev() when domain is already attached creates a reference count leak on PowerPC IOMMU platform domains, surfacing as a BUG_ON() in iommu_reconfig_notifier during DLPAR node removal.

Why it matters to the business

Unexpected kernel crashes on IBM Power systems during dynamic hardware reconfiguration or partition operations, leading to unplanned downtime and potential data loss in virtualized or enterprise server environments.

How an attack unfolds

An attacker with local access on an affected pSeries system triggers repeated IOMMU domain attach operations that hit the already-attached path, leaking references; subsequent DLPAR removal then hits the BUG_ON in the notifier chain, causing a kernel panic.

How to fix it

Upgrade to Linux kernel 6.7.6 or later, or apply commit c90fdea9cac9eb419fc266e75d625cb60c8f7f6c from the stable tree. Reboot after installing the fixed kernel.

How to confirm the fix worked

Verify running kernel version is 6.7.6 or newer; confirm presence of the iommu_group_put() call in spapr_tce_platform_iommu_attach_dev() via source inspection or binary diff against the listed commit.

Typical attack path

1. Obtain local code execution or shell on target PowerPC Linux system
2. Perform IOMMU device attach operations that exercise the spapr_tce_platform_iommu_attach_dev path while a domain is already set
3. Trigger of_reconfig_notify / DLPAR detach sequence via ofdt_write or equivalent
4. Observe kernel BUG at arch/powerpc/platforms/pseries/iommu.c:100 and system crash

How to detect it

Search kernel logs and dmesg for 'kernel BUG at arch/powerpc/platforms/pseries/iommu.c:100', 'iommu_reconfig_notifier', and 'of_detach_node' call traces on pSeries hardware; correlate with DLPAR or ofdt_write activity.

• kernel BUG at arch/powerpc/platforms/pseries/iommu.c:100
• iommu_reconfig_notifier+0x94/0x200
• of_detach_node+0x78/0xb0
• Tainted: G I

What your security team should do

• Prioritize patching PowerPC systems exposed to DLPAR or dynamic IOMMU operations within the next maintenance window
• Monitor kernel logs for the specific BUG signature during hardware reconfiguration events
• Restrict unprivileged local access on affected systems until patched