Executive brief
The Linux kernel's Intel VT-d IOMMU (Input/Output Memory Management Unit) implementation can be misconfigured to run without Access Control Services (ACS) when Trusted Boot (tboot) is enabled, potentially allowing unprivileged processes to access memory they should not be able to reach. This is a memory isolation bypass that could enable privilege escalation or data theft on systems using both tboot and VT-d virtualization security features.
Technical details
The vulnerability is a logic error in the VT-d IOMMU detection code (drivers/iommu/intel/dmar.c). When the kernel detects that tboot is enabled, it forces the IOMMU on via tboot_force_iommu(), but the earlier detect_intel_iommu() function was not checking for tboot when deciding whether to request PCI Access Control Services (ACS). This allows user-specified kernel options to disable ACS even though the IOMMU will be forcibly enabled, creating a security configuration gap. The fix adds a dmar_required() helper that checks tboot status before allowing ACS to be skipped. The vulnerability affects the IOMMU detection phase during kernel initialization and requires a system with Intel VT-d hardware and tboot enabled. The fix is backported across all stable Linux kernel versions.
Affected products
- Linux Linux kernel All versions (patch backported to 2.6.11.y through 7.2.y)
Timeline
- 2026-09-11: disclosed: CVE-2026-89448 published
- 2026-08-05: patched: Upstream fix authored by Kevin Tian
- 2026-09-07: advisory: Backported to stable kernels