CVE-2026-80687

In the Linux kernel, the following vulnerability has been resolved:

iommufd/viommu: Release the igroup lock on the vdevice size error path

iommufd vdevice alloc ioctl() takes idev->igroup->lock, then validates the driver's vdevice size against the core structure size with a WARN ON ONCE. On failure that guard jumps to out put idev, below out unlock igroup, so it skips the mutex unlock(), leaving the igroup lock held and deadlocking the next vDEVICE operation on that group.

Jump to out unlock igroup instead.