# CVE-2024-26709: linux: In the Linux kernel, the following vulnerability has been resolved:  powerpc/iommu: Fix the missing iommu_group_put()...

CVE-2024-26709 is fixed in linux on 1 platform, first by DEBIAN-CVE-2024-26709, released April 3, 2024. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2024-26709
- Priority: Routine
- CVSS: 5.5 (medium)
- EPSS: 0.0020
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Apr 3, 2024

## Description

In the Linux kernel, the following vulnerability has been resolved:  powerpc/iommu: Fix the missing iommu_group_put() during platform domain attach  The function spapr_tce_platform_iommu_attach_dev() is missing to call iommu_group_put() when the domain is already set. This refcount leak shows up with BUG_ON() during DLPAR remove operation as:    KernelBug: Kernel bug in state 'None': kernel BUG at arch/powerpc/platforms/pseries/iommu.c:100!   Oops: Exception in kernel mode, sig: 5 [#1]   LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=8192 NUMA pSeries   <snip>   Hardware name: IBM,9080-HEX POWER10 (raw) 0x800200 0xf000006 of:IBM,FW1060.00 (NH1060_016) hv:phyp pSeries   NIP:  c0000000000ff4d4 LR: c0000000000ff4cc CTR: 0000000000000000   REGS: c0000013aed5f840 TRAP: 0700   Tainted: G          I         (6.8.0-rc3-autotest-g99bd3cb0d12e)   MSR:  8000000000029033 <SF,EE,ME,IR,DR,RI,LE>  CR: 44002402  XER: 20040000   CFAR: c000000000a0d170 IRQMASK: 0   ...   NIP iommu_reconfig_notifier+0x94/0x200   LR  iommu_reconfig_notifier+0x8c/0x200   Call Trace:     iommu_reconfig_notifier+0x8c/0x200 (unreliable)     notifier_call_chain+0xb8/0x19c     blocking_notifier_call_chain+0x64/0x98     of_reconfig_notify+0x44/0xdc     of_detach_node+0x78/0xb0     ofdt_write.part.0+0x86c/0xbb8     proc_reg_write+0xf4/0x150     vfs_write+0xf8/0x488     ksys_write+0x84/0x140     system_call_exception+0x138/0x330     system_call_vectored_common+0x15c/0x2ec  The patch adds the missing iommu_group_put() call.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 13.5 (trixie) | 6.7.7-1 | [DEBIAN-CVE-2024-26709](https://patchblox.com/security/data/fix/linux/debian-cve-2024-26709.md) | Apr 3, 2024 |
| Linux | linux Debian 14 | 6.7.7-1 | [DEBIAN-CVE-2024-26709](https://patchblox.com/security/data/fix/linux/debian-cve-2024-26709.md) | Apr 3, 2024 |

---

Data as of 2026-11-08T19:12:23Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.