# CVE-2026-80633: linux: In the Linux kernel, the following vulnerability has been resolved:  iommufd: Take dma_resv lock before dma_buf_unpin...

CVE-2026-80633 is fixed in linux on 1 platform by DEBIAN-CVE-2026-80633 (version 7.1.5-1), released August 29, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-80633
- Priority: High
- CVSS: 8.8 (high)
- EPSS: 0.0017
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Aug 28, 2026

## Description

In the Linux kernel, the following vulnerability has been resolved:  iommufd: Take dma_resv lock before dma_buf_unpin() in release path  dma_buf_unpin() requires the caller to hold the exporter's dma_resv lock:    void dma_buf_unpin(struct dma_buf_attachment *attach)   {           ...           dma_resv_assert_held(dmabuf->resv);           ...   }  iopt_release_pages() calls dma_buf_unpin() without taking that lock, so every iommufd_ioas_destroy()/iommufd_ioas_unmap() that releases the last reference on a DMABUF-backed iopt_pages triggers a WARN. This was hit while running tools/testing/selftests/iommu/iommufd:    WARNING: drivers/dma-buf/dma-buf.c:1137 at dma_buf_unpin+0x62/0x70   RIP: 0010:dma_buf_unpin+0x62/0x70   Call Trace:    <TASK>    dma_buf_unpin+0x62/0x70    iopt_release_pages+0xe4/0x190    iopt_unmap_iova_range+0x1c7/0x290    iopt_unmap_all+0x1a/0x30    iommufd_ioas_destroy+0x1d/0x50    iommufd_fops_release+0x93/0x150    __fput+0xfc/0x2c0    __x64_sys_close+0x3d/0x80    do_syscall_64+0x65/0x180    </TASK>  Take the dma_resv lock around dma_buf_unpin() in iopt_release_pages(), matching the iopt_map_dmabuf() convention. dma_buf_detach() acquires the reservation lock internally, so it must remain outside the locked region.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 14 | 7.1.5-1 | [DEBIAN-CVE-2026-80633](https://patchblox.com/security/data/fix/linux/debian-cve-2026-80633.md) | Aug 29, 2026 |

---

Data as of 2026-11-08T19:12:23Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.