Executive brief
A vulnerability in the Linux kernel's Intel IOMMU driver could allow hardware to access uninitialized memory. This occurs because the system fails to clear the processor's cache before making a new memory table available to the hardware. In practice, this could lead to unpredictable system behavior or potential data leakage if the hardware processes stale information from previous operations.
Technical details
A race condition exists in the Intel VT-d (Virtualization Technology for Directed I/O) driver within the Linux kernel. When a new PASID (Process Address Space ID) table is allocated and zero-initialized, the driver was writing the table's address to the PASID directory entry before performing a CPU cache flush. On systems with non-coherent IOMMU hardware, this creates a window where the IOMMU may read stale, uninitialized data from RAM instead of the zeroed table. This is a flaw in the PASID directory pointer coherency logic. The fix reorders the operations to ensure the cache is flushed before the table is made visible to the hardware.
Affected products
- Linux Linux kernel v2.6.11 and later
Timeline
- 2026-01-22: patched: Initial patch authored by Dmytro Maluka
- 2026-05-27: disclosed: CVE published to NVD
References
- https://git.kernel.org/stable/c/0616137b70e6d9a547d4b60df8e1b64e36d83661
- https://git.kernel.org/stable/c/22d169bdd2849fe6bd18c2643742e1c02be6451c
- https://git.kernel.org/stable/c/36244dfd3853f7bf89d03b8e90d56b23ce7fbc16
- https://git.kernel.org/stable/c/36990407cdd257473607e33802d00e978af2759e
- https://git.kernel.org/stable/c/5962c30a6f05ea1ab73f039e235bb30716243517
- https://git.kernel.org/stable/c/c93f23375d8c410954b0df825e814b632fd62b9d
- https://git.kernel.org/stable/c/cd75e77125c8a51754ca4cd60b4ca083ed735d1d