---
id: CVE-2026-93205
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  iommu/arm-smmu-v3: Manage teardown with devm

  arm_smmu_device_remove() manually frees the IOPF queue, destroys the
  vmid_map and disables the device, while the IRQs and …
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  iommu/arm-smmu-v3: Manage teardown with devm

  arm_smmu_device_remove() manually frees the IOPF queue, destroys the
  vmid_map and disables the device, while the IRQs and …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    981686f4137760a16a03c5193f11d85133533f93
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    2235eafda9b3df9295efd0593cd4a8977440c3f6
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    78fd5a2d65f3546cb4285f8e52f445baecbd00e0
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    2bd22a0d40503a65d243b011de146603c8ce1cbc
  - Linux < 6.12.109
  - Linux < 6.18.50
  - Linux < 7.2.4
  - Linux (all versions)
published: '2026-09-24'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T16:17:14.523'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-93205'
references:
  - url: 'https://git.kernel.org/stable/c/2235eafda9b3df9295efd0593cd4a8977440c3f6'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/2bd22a0d40503a65d243b011de146603c8ce1cbc'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/78fd5a2d65f3546cb4285f8e52f445baecbd00e0'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/981686f4137760a16a03c5193f11d85133533f93'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-24T15:45:56.674Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

iommu/arm-smmu-v3: Manage teardown with devm

arm_smmu_device_remove() manually frees the IOPF queue, destroys the
vmid_map and disables the device, while the IRQs and queues are devm
managed. devm unwinds only after remove() returns, so the cleanup runs
in the wrong order. The IOPF queue is freed before the event-queue IRQ
whose handler uses it.

Manage all of it with devm so the unwind order is correct. Free the IOPF
queue and vmid_map via devm actions, and disable the device from one
registered after arm_smmu_device_reset().

This is also a prerequisite for fixing a Tegra241 CMDQV CMD_SYNC
use-after-free in the subsequent patch.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.