Executive brief
The Linux kernel's Intel VT-d IOMMU (a core component for hardware-assisted virtualization and device isolation) fails to properly invalidate cached context entries when tearing down DMA device aliases. An attacker or faulty device could exploit stale cache entries to access freed memory regions, potentially leading to information disclosure or privilege escalation on systems relying on IOMMU protection.
Technical details
The vulnerability exists in the VT-d IOMMU driver's context cache invalidation logic during device teardown. When processing DMA aliases via pci_for_each_dma_alias(), the functions domain_context_clear_one() and device_pasid_table_teardown() clear context entries in memory but then invoke intel_context_flush_no_pasid() with the device's own requester ID (RID) rather than the source ID of the alias being cleared. This causes hardware to fail invalidating cached entries for all aliases except the device's primary RID. In the scalable-mode teardown path, stale cached entries can reference PASID directories that are subsequently freed, allowing the IOMMU to dereference freed memory. The fix passes the correct source ID (constructed from bus/devfn) to the flush function. This is a local/adjacent attack requiring device control or privileged access, affecting kernels with the vulnerable flush helper (introduced in f90584f4beb84).
Affected products
- Linux Linux kernel Affected versions: kernels with commit f90584f4beb84 and before fix commit c54e4ae971b98e8d650400137d332cee56c03f55
Timeline
- 2026-09-17: disclosed: CVE-2026-90240 published on NVD
- 2026-08-05: patched: Fix committed by Lu Baolu (commit c54e4ae971b98e8d650400137d332cee56c03f55)
- 2026-06-02: other: Vulnerability reported via Sashiko