CVE-2026-45945

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

iommu/vt-d: Fix race condition during PASID entry replacement

The Intel VT-d PASID table entry is 512 bits (64 bytes). When replacing

an active PASID entry (e.g., during domain replacement), the current

implementation calculates a new entry on the stack and copies it to the

table using a single structure assignment.

struct pasid_entry *pte, new_pte;

pte = intel_pasid_get_entry(dev, pasid);

pasid_pte_config_first_level(iommu, &new_pte, ...);

*pte = new_pte;

Because the hardware may fetch the 512-bit PASID entry in multiple

128-bit chunks, updating the entire entry while it is active (Present

bit set) risks a "torn" read. In this scenario, the IOMMU hardware

could observe an inconsistent state — partially new data and partially

old data — leading to unpredictable behavior or spurious faults.

Fix this by removing the unsafe "replace" helpers and following the

"clear-then-update" flow,

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References