Executive brief
A vulnerability was identified in the Linux kernel's handling of Intel virtualization technology (VT-d). The system's memory management hardware could occasionally read incomplete or 'torn' configuration data during updates, potentially causing the system to behave unpredictably or crash. This issue primarily affects system stability and the reliable isolation of hardware components in virtualized environments.
Technical details
A race condition exists in the iommu/vt-d implementation when tearing down context entries. The driver previously zeroed 128-bit context entries using multiple 64-bit writes without ensuring the 'Present' (P) bit was cleared first. This created a window where hardware could fetch a 'torn' entry—where some fields are zeroed but the entry is still marked as present—violating the VT-d specification's ownership handshake requirements. An attacker or a malfunctioning driver could trigger this during device detachment or domain teardown, leading to IOMMU faults or unpredictable DMA behavior. The fix implements the proper handshake by clearing the P bit, issuing a memory barrier (dma_wmb), invalidating caches, and only then zeroing the full entry.
Affected products
- Linux Linux Kernel All versions prior to the fix in 2026
Timeline
- 2026-01-22: patched: Initial patch authored by Lu Baolu
- 2026-05-27: disclosed: CVE-2026-45944 published