CVE-2026-89445 addresses a use-after-free vulnerability in the Linux kernel's iommufd selftest IOPF reporting. The issue arises because the TRIGGER_IOPF test borrows an attach handle from group->pasid_array without synchronizing against PASID detach operations. Concurrent calls to iommu_report_device_fault() can dereference a domain pointer from a freed attach handle, causing a UAF. The patch adds a read-write semaphore (iopf_rwsem) in the mock device driver to synchronize access, holding the read lock during iommu_report_device_fault() and the write lock during attach, detach, or replacement of device domains, preventing access to freed memory.

The vulnerability could lead to use-after-free memory corruption in the Linux kernel, potentially causing system instability or crashes. No information about exploitation in the wild is available.

A fix has been implemented in the Linux kernel by adding proper synchronization using a read-write semaphore to prevent use-after-free conditions. Users should apply the official kernel update containing this patch once available. No alternative mitigations are indicated.