CVE-2026-45894

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

iommu/vt-d: Clear Present bit before tearing down PASID entry

The Intel VT-d Scalable Mode PASID table entry consists of 512 bits (64

bytes). When tearing down an entry, the current implementation zeros the

entire 64-byte structure immediately using multiple 64-bit writes.

Since the IOMMU hardware may fetch these 64 bytes using multiple

internal transactions (e.g., four 128-bit bursts), updating or zeroing

the entire entry while it is active (P=1) risks a "torn" read. If a

hardware fetch occurs simultaneously with the CPU zeroing the entry, the

hardware could observe an inconsistent state, leading to unpredictable

behavior or spurious faults.

Follow the "Guidance to Software for Invalidations" in the VT-d spec

(Section 6.5.3.3) by implementing the recommended ownership handshake:

1. Clear only the 'Present' (P) bit of the PASID entry.

2. Use a dma_wmb() to ensure the cleared bit is visible to hardware

before pr

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References