CVE-2026-89452

In the Linux kernel, the following vulnerability has been resolved:

iommu/msm: Unwind probe state on registration failure

msm iommu probe() adds its devm-managed IOMMU object to qcom iommu devices before adding the IOMMU sysfs device and registering it with the IOMMU core.

If iommu device sysfs add() fails, probe returns with the object still on qcom iommu devices. The driver core then releases the devm allocation, leaving a dangling list entry that later list walks may dereference.

If iommu device register() fails, the same dangling list entry remains and the sysfs device is left registered as well.

Unwind the sysfs device and global list entry in reverse setup order on the corresponding failure paths.