CVE-2026-23429: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23429 is a use-after-free vulnerability in the Linux kernel's IOMMU SVA (Shared Virtual Addressing) subsystem, specifically in the iommu_sva_unbind_device() function. The flaw allows a local, low-privileged attacker to trigger a kernel crash by causing the kernel to dereference a freed memory structure (domain->mm->iommu_mm) after iommu_domain_free() has released it. Affected versions include Linux kernel 6.18.7 through 6.18.19, 6.19.1 through 6.19.9, and 7.0-rc1 through 7.0-rc6. It was published on April 3, 2026, with patches released shortly after. The CVSS v3.1 base score is 5.5 (Medium) (GitHub Advisory, Feedly).

The root cause is a use-after-free condition (CWE-416) in the iommu_sva_unbind_device() function within the Linux kernel's IOMMU SVA subsystem. When iommu_domain_free() is called, it triggers a chain — mmdrop() → __mmdrop() → mm_pasid_drop() — that frees domain->mm->iommu_mm. If code subsequently accesses domain->mm->iommu_mm after this call returns, it dereferences freed memory, leading to a kernel crash or panic. The fix reorders execution so that any access to domain->mm->iommu_mm occurs before the iommu_domain_free() call, eliminating the race condition. Exploitation requires local access with low privileges and no user interaction (GitHub Advisory, Feedly).

Successful exploitation results in a kernel crash or panic on systems with IOMMU SVA enabled, causing a denial of service and system instability. The vulnerability has no impact on confidentiality or data integrity — the sole consequence is high availability impact, as the kernel process terminates abnormally. Lateral movement or data exfiltration are not directly enabled by this vulnerability (GitHub Advisory, Feedly).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of writing. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017%, indicating a very low probability of exploitation in the near term. Exploitation requires local access with low privileges on a system where IOMMU SVA is enabled (GitHub Advisory, Feedly).

Update the Linux kernel to a patched version: 6.18.20 or later, 6.19.10 or later, or 7.0-rc5 or later. Patches are available at the official kernel stable repository commits (kernel patch 1, kernel patch 2, kernel patch 3). Amazon Linux 2023 users can apply the fix via ALAS2023-2026-1596. As a temporary workaround if patching is not immediately possible, restrict local access to systems with IOMMU SVA enabled, or disable IOMMU SVA if it is not required for operations (Feedly, GitHub Advisory).