CVE-2025-38216

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

iommu/vt-d: Restore context entry setup order for aliased devices

Commit 2031c469f816 ("iommu/vt-d: Add support for static identity domain")

changed the context entry setup during domain attachment from a

set-and-check policy to a clear-and-reset approach. This inadvertently

introduced a regression affecting PCI aliased devices behind PCIe-to-PCI

bridges.

Specifically, keyboard and touchpad stopped working on several Apple

Macbooks with below messages:

kernel: platform pxa2xx-spi.3: Adding to iommu group 20

kernel: input: Apple SPI Keyboard as

/devices/pci0000:00/0000:00:1e.3/pxa2xx-spi.3/spi_master/spi2/spi-APP000D:00/input/input0

kernel: DMAR: DRHD: handling fault status reg 3

kernel: DMAR: [DMA Read NO_PASID] Request device [00:1e.3] fault addr

0xffffa000 [fault reason 0x06] PTE Read access is not set

kernel: DMAR: DRHD: handling fault status reg 3

kernel: DMAR: [DMA Read NO_PASID] Request device [00:1e.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References