CVE-2024-26785

What it actually does

Race condition in iommufd allows concurrent access->ioas to be set to NULL while iommufd_test_syz_conv_iova holds no lock, resulting in null pointer dereference during down_read.

Why it matters to the business

Local users on affected Linux kernels can trigger kernel crashes or denial of service; the bug affects device IOMMU management used in virtualization and hardware passthrough workloads, with potential for broader kernel compromise on systems running unpatched kernels including Android.

How an attack unfolds

An attacker with local access invokes the iommufd ioctl path that triggers iommufd_test_access_rw while a concurrent iommufd_access_change_ioas clears access->ioas; the missing sanity check allows the subsequent lock acquisition on a NULL pointer, leading to general protection fault. Named threat actors have targeted similar Android kernel IOMMU paths for remote code execution chains.

How to fix it

Update to Linux kernel commit fd4d5cd7a2e8f08357c9bfc0905957cffe8ce568 or later stable releases that include the access->ioas sanity checks matching iommufd_access_rw and iommufd_access_pin_pages.

How to confirm the fix worked

Confirm kernel version contains fd4d5cd7a2e8f08357c9bfc0905957cffe8ce568; review source for presence of the ioas NULL check before down_read in test conversion path; run syzkaller or equivalent fuzzing to verify absence of the reported fault.

Typical attack path

1. Obtain local code execution or user shell on target Linux/Android system
2. Open /dev/iommu or equivalent iommufd file descriptor
3. Issue ioctl sequence that races iommufd_access_change_ioas with iommufd_test_access_rw
4. Trigger null pointer dereference to crash kernel or attempt further exploitation

How to detect it

Search kernel logs for general protection fault with KASAN null-ptr-deref mentioning iommufd_test_syz_conv_iova or iommufd_test_access_rw; inspect auditd or syscall logs for unusual ioctl sequences on iommufd file descriptors around crash timestamps.

• general protection fault.*iommufd_test_syz_conv_iova
• KASAN: null-ptr-deref in range [0x00000000000001c0-0x00000000000001c7]
• iommufd_test_access_rw.isra.0

What your security team should do

• Prioritize kernel upgrade to the listed fixed commit on all affected systems within standard patch windows
• Restrict unprivileged access to iommufd devices via device permissions or SELinux/AppArmor policies
• Monitor EPSS and KEV updates for any future elevation in exploitability