Executive brief
A race condition was identified in the Linux kernel's handling of Intel VT-d virtualization technology. This flaw could allow a local attacker to cause unpredictable system behavior or crashes by triggering a specific timing issue when the system updates memory access permissions for virtualized devices. While primarily affecting system stability, it could potentially be used to disrupt operations on servers using Intel IOMMU hardware.
Technical details
A race condition exists in the Intel VT-d (IOMMU) driver within the Linux kernel during PASID (Process Address Space ID) entry replacement. The vulnerability stems from the driver attempting to update 512-bit PASID table entries using a single structure assignment while the 'Present' bit is active. Because the underlying hardware may fetch these 64-byte entries in multiple 128-bit chunks, the IOMMU hardware can perform a 'torn' read, observing an inconsistent state consisting of partial old and partial new data. This can result in unpredictable hardware behavior or spurious faults. The fix involves implementing a 'clear-then-update' flow that clears the Present bit and performs a proper invalidation handshake before applying new configurations.
Affected products
- Linux Linux Kernel Versions prior to fixes in 66a7aff and c3b1ede
Timeline
- 2026-01-22: patched: Fix committed to Linux stable tree
- 2026-05-27: disclosed: CVE published