Executive brief
The Linux kernel's Intel IOMMU driver manages memory access protection for devices using DMA (direct memory access). During device initialization, if context entry setup fails partway through, the code freed the PASID table without properly tearing down associated context entries. This left active context entries pointing to freed memory, allowing the IOMMU to dereference invalid memory addresses and potentially causing system crashes or data corruption.
Technical details
The vulnerability is a use-after-free flaw in the Intel IOMMU scalable-mode context setup path (drivers/iommu/intel/iommu.c). When intel_iommu_probe_device() calls intel_pasid_setup_sm_context() to configure PASID table context entries for each DMA alias RID, a failure partway through the walk leaves context entries pointing to the device's PASID table. On the error path, intel_pasid_free_table() was called directly without first tearing down those context entries via intel_pasid_teardown_sm_context(). This left present context entries with dangling pointers to freed memory. The IOMMU hardware could then walk these stale entries and dereference freed memory. The fix adds intel_pasid_teardown_sm_context() before intel_pasid_free_table() on the probe failure path, mirroring the correct teardown order already used in intel_iommu_release_device().
Affected products
- Linux Linux kernel affected versions likely 5.15.y through 6.x kernels based on patch distribution
Timeline
- 2026-09-17: disclosed: CVE-2026-90241 disclosed
- 2026-08-10: patched: upstream fix committed by Joerg Roedel