Executive brief
The Linux kernel's VT-d IOMMU driver has a race condition in how it removes device context entries during teardown. The vulnerability allows hardware to fetch a partially-cleared entry while the Present bit is still active, potentially causing unpredictable device behavior, spurious memory access faults, or denial of service. This affects systems with Intel VT-d IOMMU hardware used for device passthrough and memory isolation.
Technical details
The vulnerability exists in the copied_context_tear_down() function in drivers/iommu/intel/iommu.c, where a 128-bit context entry is zeroed while the Present bit remains set. The function then issues cache and IOTLB invalidations, creating a race window where hardware can fetch a torn entry with some fields zeroed but Present still active. The root cause is lack of atomic clearing: the compiler may reorder writes to the two 64-bit halves of the entry, and hardware fetch is not guaranteed atomic with respect to multiple CPU writes. Additionally, on non-coherent IOMMUs, the zeroed entry may not be visible to hardware before invalidation submission. The fix applies the VT-d spec guidance: clear only the Present bit first, flush it to the IOMMU, perform invalidations, then zero the remainder of the entry. No authentication is required—local code on the kernel path exploits this during device context cleanup.
Affected products
- Linux Linux kernel Multiple versions (VT-d IOMMU driver affected from c7191984e5aad onwards)
Timeline
- 2026-09-17: disclosed: CVE-2026-90243 published
- 2026-08-05: patched: Upstream fix committed by Lu Baolu
- 2026-09-14: other: Patch backported to stable kernel trees