CVE-2026-74439

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry

device_pasid_table_teardown() zeroes the 128-bit scalable-mode context

entry with context_clear_entry() while the Present bit is still set. This

creates a window where the hardware can fetch a torn entry, with some

fields already zeroed while Present is still set, leading to unpredictable

behavior or spurious faults. The context-cache invalidation is issued only

after the entry has been zeroed, and intel_pasid_free_table() then frees

the PASID directory pages, so the IOMMU can keep walking a stale Present=1

entry that points at freed memory.

While x86 provides strong write ordering, the compiler may reorder the two

64-bit writes to the entry, and the hardware fetch is not guaranteed to be

atomic with respect to multiple CPU writes.

Commit c1e4f1dccbe9d ("iommu/vt-d: Clear Present bit before tearing down

context entry") fixed this exact pa

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References