Executive brief
A vulnerability was identified in the Linux kernel's support for RISC-V processors. The system's memory management component (IOMMU) failed to properly clear its internal cache after making changes to how devices access memory. This could potentially allow unauthorized access to memory or cause system instability on RISC-V based hardware.
Technical details
A vulnerability exists in the Linux kernel's RISC-V IOMMU driver (drivers/iommu/riscv/iommu.c). The driver failed to issue IOTINVAL commands after updating Device Directory Table (DDT) or Process Directory Table (PDT) entries, which is required by Sections 6.3.1 and 6.3.2 of the RISC-V IOMMU specification. Without these invalidations, the IOMMU may continue to use stale Translation Lookaside Buffer (TLB) or context cache entries. This could lead to memory corruption or bypasses of I/O memory protection. The fix introduces riscv_iommu_iodir_iotinval() to ensure proper cache invalidation. Patches are available in various stable kernel branches including 6.18.33 and 7.0.10.
Affected products
- Linux Linux 6.13, 6.18.33, 7.0.10, 7.1
Timeline
- 2026-06-24: disclosed
- 2026-06-24: advisory