CVE-2026-74439 (GCVE-0-2026-74439)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:59 – Updated: 2026-08-17 05:47
VLAI
Title
iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry
Summary
In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry device_pasid_table_teardown() zeroes the 128-bit scalable-mode context entry with context_clear_entry() while the Present bit is still set. This creates a window where the hardware can fetch a torn entry, with some fields already zeroed while Present is still set, leading to unpredictable behavior or spurious faults. The context-cache invalidation is issued only after the entry has been zeroed, and intel_pasid_free_table() then frees the PASID directory pages, so the IOMMU can keep walking a stale Present=1 entry that points at freed memory. While x86 provides strong write ordering, the compiler may reorder the two 64-bit writes to the entry, and the hardware fetch is not guaranteed to be atomic with respect to multiple CPU writes. Commit c1e4f1dccbe9d ("iommu/vt-d: Clear Present bit before tearing down context entry") fixed this exact pattern in domain_context_clear_one() and the copied-context path, but device_pasid_table_teardown() was not converted. Align it with the "Guidance to Software for Invalidations" in the VT-d spec, Section 6.5.3.3, using the same ownership handshake as the sibling fix: clear only the Present bit, flush it to the IOMMU, perform the context-cache invalidation, and only then zero the rest of the entry.
Severity
9.3 (Critical)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 81e921fd321614c2ad8ac333b041aae1da7a1c6d , < e9e83bcfe37dc719182500dd823c03ab57d934f0 (git)
Affected: 81e921fd321614c2ad8ac333b041aae1da7a1c6d , < 588718101e8449605f1c7e858fecb7cfa701cdab (git)
Affected: 81e921fd321614c2ad8ac333b041aae1da7a1c6d , < 7fd4077dc92b91b1b844333c0a06bb9e286db10a (git)
Affected: 81e921fd321614c2ad8ac333b041aae1da7a1c6d , < f46452c3df7a8d8a5addc0926e76ef19ea7da0a0 (git)
Affected: 333fe86968482ca701c609af590003bcea450e8f (git)
Affected: 6.8.2 , < 6.9 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.9
Unaffected: 0 , < 6.9 (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/intel/pasid.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e9e83bcfe37dc719182500dd823c03ab57d934f0",
              "status": "affected",
              "version": "81e921fd321614c2ad8ac333b041aae1da7a1c6d",
              "versionType": "git"
            },
            {
              "lessThan": "588718101e8449605f1c7e858fecb7cfa701cdab",
              "status": "affected",
              "version": "81e921fd321614c2ad8ac333b041aae1da7a1c6d",
              "versionType": "git"
            },
            {
              "lessThan": "7fd4077dc92b91b1b844333c0a06bb9e286db10a",
              "status": "affected",
              "version": "81e921fd321614c2ad8ac333b041aae1da7a1c6d",
              "versionType": "git"
            },
            {
              "lessThan": "f46452c3df7a8d8a5addc0926e76ef19ea7da0a0",
              "status": "affected",
              "version": "81e921fd321614c2ad8ac333b041aae1da7a1c6d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "333fe86968482ca701c609af590003bcea450e8f",
              "versionType": "git"
            },
            {
              "lessThan": "6.9",
              "status": "affected",
              "version": "6.8.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/intel/pasid.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.8.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: Clear Present bit before tearing down scalable-mode context entry\n\ndevice_pasid_table_teardown() zeroes the 128-bit scalable-mode context\nentry with context_clear_entry() while the Present bit is still set. This\ncreates a window where the hardware can fetch a torn entry, with some\nfields already zeroed while Present is still set, leading to unpredictable\nbehavior or spurious faults. The context-cache invalidation is issued only\nafter the entry has been zeroed, and intel_pasid_free_table() then frees\nthe PASID directory pages, so the IOMMU can keep walking a stale Present=1\nentry that points at freed memory.\n\nWhile x86 provides strong write ordering, the compiler may reorder the two\n64-bit writes to the entry, and the hardware fetch is not guaranteed to be\natomic with respect to multiple CPU writes.\n\nCommit c1e4f1dccbe9d (\"iommu/vt-d: Clear Present bit before tearing down\ncontext entry\") fixed this exact pattern in domain_context_clear_one() and\nthe copied-context path, but device_pasid_table_teardown() was not\nconverted.\n\nAlign it with the \"Guidance to Software for Invalidations\" in the VT-d\nspec, Section 6.5.3.3, using the same ownership handshake as the sibling\nfix: clear only the Present bit, flush it to the IOMMU, perform the\ncontext-cache invalidation, and only then zero the rest of the entry."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is in Intel VT-d scalable-mode PASID context teardown reached only via local kernel IOMMU device-release paths (intel_iommu_release_device \u2192 device_pasid_table_teardown), triggered by PCI hot-unplug, sysfs driver unbind, or iommu deinit\u2014not by any network-facing protocol.\nAC:L - This is a use-after-free where intel_pasid_free_table() frees PASID directory pages while the IOMMU may still cache a Present=1 context entry; an attacker controlling a PASID-capable device can keep DMA active and time bus removal/teardown to hit the stale-entry window reliably (AC:L per UAF guidance).\nPR:N - A malicious PASID-capable PCIe device can trigger the vulnerable intel_iommu_release_device teardown by physical hot-unplug (pci_stop_and_remove_bus_device) while sustaining DMA, requiring no authenticated host account or capability on the target system.\nUI:N - No victim interaction is required beyond the attacker\u0027s own device removal or driver-unbind orchestration; the vulnerable teardown executes automatically once the PCI/IOMMU release path runs.\nS:C - A stale or torn scalable-mode context entry breaks VT-d DMA isolation\u2014the IOMMU can translate device DMA against freed PASID table memory, crossing the device/host (or guest/host) IOMMU security boundary per kernel IOMMU bypass guidance.\nC:H - With the IOMMU walking freed PASID directory pages, a controlled device can DMA-read host physical memory outside its assigned domain, yielding arbitrary cross-boundary read disclosure (C:H; UAF enables attacker influence over translation contents).\nI:H - The same mistranslation gives the device an arbitrary DMA write primitive against host memory outside its domain, enabling data modification and potential control-flow hijack via memory corruption (standard UAF/IOMMU-bypass I:H guidance).\nA:H - The commit documents unpredictable behavior and spurious DMAR faults from torn Present entries; freed PASID tables under active IOMMU walks can fault-storm, hang, or panic the host\u2014any kernel crash/UAF qualifies as A:H."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:47:13.219Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e9e83bcfe37dc719182500dd823c03ab57d934f0"
        },
        {
          "url": "https://git.kernel.org/stable/c/588718101e8449605f1c7e858fecb7cfa701cdab"
        },
        {
          "url": "https://git.kernel.org/stable/c/7fd4077dc92b91b1b844333c0a06bb9e286db10a"
        },
        {
          "url": "https://git.kernel.org/stable/c/f46452c3df7a8d8a5addc0926e76ef19ea7da0a0"
        }
      ],
      "title": "iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74439",
    "datePublished": "2026-08-15T05:59:36.655Z",
    "dateReserved": "2026-08-15T05:44:03.897Z",
    "dateUpdated": "2026-08-17T05:47:13.219Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74439",
      "date": "2026-09-21",
      "epss": "0.00134",
      "percentile": "0.03258"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/iommu/intel/pasid.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "e9e83bcfe37dc719182500dd823c03ab57d934f0",
                    "status": "affected",
                    "version": "81e921fd321614c2ad8ac333b041aae1da7a1c6d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "588718101e8449605f1c7e858fecb7cfa701cdab",
                    "status": "affected",
                    "version": "81e921fd321614c2ad8ac333b041aae1da7a1c6d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7fd4077dc92b91b1b844333c0a06bb9e286db10a",
                    "status": "affected",
                    "version": "81e921fd321614c2ad8ac333b041aae1da7a1c6d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f46452c3df7a8d8a5addc0926e76ef19ea7da0a0",
                    "status": "affected",
                    "version": "81e921fd321614c2ad8ac333b041aae1da7a1c6d",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "333fe86968482ca701c609af590003bcea450e8f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6.9",
                    "status": "affected",
                    "version": "6.8.2",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/iommu/intel/pasid.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.9"
                  },
                  {
                    "lessThan": "6.9",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: Clear Present bit before tearing down scalable-mode context entry\n\ndevice_pasid_table_teardown() zeroes the 128-bit scalable-mode context\nentry with context_clear_entry() while the Present bit is still set. This\ncreates a window where the hardware can fetch a torn entry, with some\nfields already zeroed while Present is still set, leading to unpredictable\nbehavior or spurious faults. The context-cache invalidation is issued only\nafter the entry has been zeroed, and intel_pasid_free_table() then frees\nthe PASID directory pages, so the IOMMU can keep walking a stale Present=1\nentry that points at freed memory.\n\nWhile x86 provides strong write ordering, the compiler may reorder the two\n64-bit writes to the entry, and the hardware fetch is not guaranteed to be\natomic with respect to multiple CPU writes.\n\nCommit c1e4f1dccbe9d (\"iommu/vt-d: Clear Present bit before tearing down\ncontext entry\") fixed this exact pattern in domain_context_clear_one() and\nthe copied-context path, but device_pasid_table_teardown() was not\nconverted.\n\nAlign it with the \"Guidance to Software for Invalidations\" in the VT-d\nspec, Section 6.5.3.3, using the same ownership handshake as the sibling\nfix: clear only the Present bit, flush it to the IOMMU, perform the\ncontext-cache invalidation, and only then zero the rest of the entry."
          }
        ],
        "id": "CVE-2026-74439",
        "lastModified": "2026-08-17T06:19:39.613",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 9.3,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.5,
              "impactScore": 6.0,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:22:46.023",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/588718101e8449605f1c7e858fecb7cfa701cdab"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7fd4077dc92b91b1b844333c0a06bb9e286db10a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e9e83bcfe37dc719182500dd823c03ab57d934f0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f46452c3df7a8d8a5addc0926e76ef19ea7da0a0"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-20T23:33:29+00:00",
      "cve": "CVE-2026-74439",
      "id": "CVE-2026-74439",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74439.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-15T01:21:07Z",
      "cve": "CVE-2026-74439",
      "id": "CVE-2026-74439",
      "initial_release_date": "2026-08-25T01:20:25Z",
      "product_status:known_affected": "177",
      "product_status:known_not_affected": "185",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74439",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74439.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.