CVE-2026-52952
published 2026-06-24CVE-2026-52952: In the Linux kernel, the following vulnerability has been resolved: iommu: Fix WARN_ON in __iommu_group_set_domain_nofail() due to reset In…
PriorityP343high8.8CVSS 3.1
AVLACLPRLUINSCCHIHAH
EPSS
0.13%
3.1th percentile
In the Linux kernel, the following vulnerability has been resolved:
iommu: Fix WARN_ON in __iommu_group_set_domain_nofail() due to reset
In __iommu_group_set_domain_internal(), concurrent domain attachments are
rejected when any device in the group is recovering. This is necessary to
fence concurrent attachments to a multi-device group where devices might
share the same RID due to PCI DMA alias quirks, but triggers the WARN_ON in
__iommu_group_set_domain_nofail().
Other IOMMU_SET_DOMAIN_MUST_SUCCEED callers in detach/teardown paths, such
as __iommu_group_set_core_domain and __iommu_release_dma_ownership, should
not be rejected, as the domain would be freed anyway in these nofail paths
while group->domain is still pointing to it. So pci_dev_reset_iommu_done()
could trigger a UAF when re-attaching group->domain.
Honor the IOMMU_SET_DOMAIN_MUST_SUCCEED flag, allowing the callers through
the group->recovery_cnt fence, so as to update the group->domain pointer.
Instead add a gdev->blocked check in the device iteration loop, to prevent
any concurrent per-device detachment.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= c279e83953d937470f8a6e69b69f62608714f13f < 8fc289e809f3eb7e36cadc4684ab6fad747a5a93 | 8fc289e809f3eb7e36cadc4684ab6fad747a5a93 |
| linux | linux | >= c279e83953d937470f8a6e69b69f62608714f13f < 5474e6e17a262db45c60575c73f70210f5c7001f | 5474e6e17a262db45c60575c73f70210f5c7001f |
| linux | linux_kernel | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
vendor_redhat7.0HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Linux Kernel up to 7.0.9 iommu __iommu_group_set_domain_nofail use after free (WID-SEC-2026-2077)
vuldb·2026-06-29·CVSS 8.8
CVE-2026-52952 [HIGH] Linux Kernel up to 7.0.9 iommu __iommu_group_set_domain_nofail use after free (WID-SEC-2026-2077)
A vulnerability identified as critical has been detected in Linux Kernel up to 7.0.9. This impacts the function __iommu_group_set_domain_nofail of the component iommu. Performing a manipulation results in use after free.
This vulnerability is known as CVE-2026-52952. Access to the local network is required for this attack. No exploit is available.
You should upgrade the affected component.
GHSA
In the Linux kernel, the following vulnerability has been resolved: iommu: Fix WARN_ON in __iommu_group_set_domain_nofail() due to reset In __iommu_group_set_domain_internal(), concurrent domain att
ghsa_unreviewed·2026-06-24
CVE-2026-52952 In the Linux kernel, the following vulnerability has been resolved: iommu: Fix WARN_ON in __iommu_group_set_domain_nofail() due to reset In __iommu_group_set_domain_internal(), concurrent domain att
In the Linux kernel, the following vulnerability has been resolved:
iommu: Fix WARN_ON in __iommu_group_set_domain_nofail() due to reset
In __iommu_group_set_domain_internal(), concurrent domain attachments are
rejected when any device in the group is recovering. This is necessary to
fence concurrent attachments to a multi-device group where devices might
share the same RID due to PCI DMA alias quirks, but triggers the WARN_ON in
__iommu_group_set_domain_nofail().
Other IOMMU_SET_DOMAIN_MUST_SUCCEED callers in detach/teardown paths, such
as __iommu_group_set_core_domain and __iommu_release_dma_ownership, should
not be rejected, as the domain would be freed anyway in these nofail paths
while group->domain is still pointing to it. So pci_dev_reset_iommu_done()
could trigger a UAF when re-
Red Hat
kernel: iommu: Fix WARN_ON in __iommu_group_set_domain_nofail() due to reset
vendor_redhat·2026-06-24·CVSS 7.0
CVE-2026-52952 [HIGH] CWE-825 kernel: iommu: Fix WARN_ON in __iommu_group_set_domain_nofail() due to reset
kernel: iommu: Fix WARN_ON in __iommu_group_set_domain_nofail() due to reset
In the Linux kernel, the following vulnerability has been resolved:
iommu: Fix WARN_ON in __iommu_group_set_domain_nofail() due to reset
In __iommu_group_set_domain_internal(), concurrent domain attachments are
rejected when any device in the group is recovering. This is necessary to
fence concurrent attachments to a multi-device group where devices might
share the same RID due to PCI DMA alias quirks, but triggers the WARN_ON in
__iommu_group_set_domain_nofail().
Other IOMMU_SET_DOMAIN_MUST_SUCCEED callers in detach/teardown paths, such
as __iommu_group_set_core_domain and __iommu_release_dma_ownership, should
not be rejected, as the domain would be freed anyway in these nofail paths
while group->domain is still
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/5474e6e17a262db45c60575c73f70210f5c7001fhttps://git.kernel.org/stable/c/8fc289e809f3eb7e36cadc4684ab6fad747a5a93https://access.redhat.com/security/cve/CVE-2026-52952https://bugzilla.redhat.com/show_bug.cgi?id=2492422https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52952.json
2026-06-24
Published