CVE-2026-89449

In the Linux kernel, the following vulnerability has been resolved:

iommu: Fix dev iommu memory leak when device add fails in iommu mock device add

iommu mock device add() first calls iommu fwspec init(), which on success allocates both dev->iommu (via dev iommu get()) and dev->iommu->fwspec. If the subsequent device add(dev) call fails, the error path only calls iommu fwspec free(dev), which frees fwspec but leaves dev->iommu still allocated.

This triggers the following kmemleak report when fuzzing with Syzkaller:

BUG: memory leak unreferenced object 0xffff888011e0a200 (size 192): comm "syz.1.1695", pid 24885, jiffies 4295222527 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 ad 4e ad de .............N.. ff ff ff ff 00 00 00 00 ff ff ff ff ff ff ff ff ................ backtrace (crc 25df5bb3): kmemleak alloc recursive include/linux/kmemleak.h:44 [inline] slab post alloc hook mm/slub.c:4575 [inline] slab alloc node mm/slub.c:4899 [inline] kmalloc cache noprof+0x47a/0x710 mm/slub.c:5415 kmalloc noprof include/linux/slab.h:950 [inline] kzalloc noprof include/linux/slab.h:1188 [inline] dev iommu get+0x10c/0x1a0 drivers/iommu/iommu.c:408 iommu fwspec init+0x288/0x4d0 drivers/iommu/iommu.c:3087 iommu mock device add+0x46/0xb0 drivers/iommu/iommu.c:385 mock dev create drivers/iommu/iommufd/selftest.c:1025 [inline] iommufd test mock domain drivers/iommu/iommufd/selftest.c:1066 [inline] iommufd test+0x2f8a/0x6190 drivers/iommu/iommufd/selftest.c:2072 iommufd fops ioctl+0x367/0x540 drivers/iommu/iommufd/main.c:533 vfs ioctl fs/ioctl.c:51 [inline] do sys ioctl fs/ioctl.c:597 [inline] se sys ioctl fs/ioctl.c:583 [inline] x64 sys ioctl+0x18e/0x210 fs/ioctl.c:583 do syscall x64 arch/x86/entry/syscall 64.c:63 [inline] do syscall 64+0x116/0x800 arch/x86/entry/syscall 64.c:94 entry SYSCALL 64 after hwframe+0x77/0x7f

Fix this by calling dev iommu free(dev) instead of iommu fwspec free(dev) in the device add() failure path. dev iommu free() frees both fwspec and the outer dev iommu struct and clears dev->iommu.