CVE-2026-80633

In the Linux kernel, the following vulnerability has been resolved:

iommufd: Take dmaresv lock before dmabuf_unpin() in release path

dmabufunpin() requires the caller to hold the exporter's dma_resv lock:

void dmabufunpin(struct dmabufattachment *attach) { ... dmaresvassert_held(dmabuf->resv); ... }

ioptreleasepages() calls dmabufunpin() without taking that lock, so every iommufdioasdestroy()/iommufdioasunmap() that releases the last reference on a DMABUF-backed iopt_pages triggers a WARN. This was hit while running tools/testing/selftests/iommu/iommufd:

WARNING: drivers/dma-buf/dma-buf.c:1137 at dmabufunpin+0x62/0x70 RIP: 0010:dmabufunpin+0x62/0x70 Call Trace: <TASK> dmabufunpin+0x62/0x70 ioptreleasepages+0xe4/0x190 ioptunmapiovarange+0x1c7/0x290 ioptunmapall+0x1a/0x30 iommufdioasdestroy+0x1d/0x50 iommufdfops_release+0x93/0x150 __fput+0xfc/0x2c0 __x64sysclose+0x3d/0x80 dosyscall64+0x65/0x180 </TASK>

Take the dmaresv lock around dmabufunpin() in ioptreleasepages(), matching the ioptmapdmabuf() convention. dmabuf_detach() acquires the reservation lock internally, so it must remain outside the locked region.