CVE-2026-89447

In the Linux kernel, the following vulnerability has been resolved:

iommufd: Avoid locking internal accesses during unmap

iommufd access notify unmap() skips internal accesses because they do not have an external unmap callback to invoke.

However, the current test calls iommufd lock obj() before checking whether the access is internal. If iommufd lock obj() succeeds, the loop then sees the internal access and continues, bypassing the matching iommufd put object() used by the normal unmap path. This leaks the object reference taken by iommufd lock obj().

Check for internal accesses first so skipped entries are never locked.