{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-45862", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-13T15:03:33.080Z", "datePublished": "2026-05-27T12:15:41.903Z", "dateUpdated": "2026-08-05T12:28:37.806Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:28:37.806Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: Flush cache for PASID table before using it\n\nWhen writing the address of a freshly allocated zero-initialized PASID\ntable to a PASID directory entry, do that after the CPU cache flush for\nthis PASID table, not before it, to avoid the time window when this\nPASID table may be already used by non-coherent IOMMU hardware while\nits contents in RAM is still some random old data, not zero-initialized." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable PASID-table allocation is reached locally via IOMMU domain attach (SVA bind through an accelerator device, or guest/IOMMUFD device setup) using syscalls/ioctls; there is no network-facing path to this code.\nAC:H - Exploitation requires non-coherent VT-d hardware and winning a nanosecond-scale cache-writeback race in which the IOMMU must read the entry before the CPU flushes the zeroes to RAM, with the stale data happening to form a usable present entry — conditions governed by microarchitectural timing the attacker cannot control.\nPR:L - An unprivileged local user with access to an SVA-capable accelerator device can drive `iommu_sva_bind_device` to trigger the PASID-table allocation while controlling the device's DMA; no real root is required.\nUI:N - The allocation and the device DMA are driven entirely by the attacker; no victim interaction is needed.\nS:C - The IOMMU enforces the DMA isolation boundary; using stale garbage PASID entries lets a device's DMA escape its assigned domain, impacting host physical memory in a different security authority — an IOMMU/DMA boundary bypass.\nC:H - A misdirected DMA translated through a garbage page table can read arbitrary host physical memory, yielding disclosure beyond the device's domain.\nI:H - The same misdirected DMA path provides write access to arbitrary host physical memory, allowing corruption of kernel data outside the device's intended domain.\nA:H - Garbage PASID entries can cause IOMMU faults, DMA failures, and memory corruption leading to oops/panic or device/system hangs." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/iommu/intel/pasid.c" ], "versions": [ { "version": "7e00b52c8cdd9d3a985d63d72ecae7bde6314883", "lessThan": "cd75e77125c8a51754ca4cd60b4ca083ed735d1d", "status": "affected", "versionType": "git" }, { "version": "5c65f097124770c3e5b9b83ed1a8b68c119bc7b5", "lessThan": "0616137b70e6d9a547d4b60df8e1b64e36d83661", "status": "affected", "versionType": "git" }, { "version": "2bed9455db7cc0ab7ece6b3d846472097b52855a", "lessThan": "36990407cdd257473607e33802d00e978af2759e", "status": "affected", "versionType": "git" }, { "version": "194b3348bdbb7db65375c72f3f774aee4cc6614e", "lessThan": "c93f23375d8c410954b0df825e814b632fd62b9d", "status": "affected", "versionType": "git" }, { "version": "194b3348bdbb7db65375c72f3f774aee4cc6614e", "lessThan": "5962c30a6f05ea1ab73f039e235bb30716243517", "status": "affected", "versionType": "git" }, { "version": "194b3348bdbb7db65375c72f3f774aee4cc6614e", "lessThan": "36244dfd3853f7bf89d03b8e90d56b23ce7fbc16", "status": "affected", "versionType": "git" }, { "version": "194b3348bdbb7db65375c72f3f774aee4cc6614e", "lessThan": "d15cda135148ea7ba929cfdbcf208182bc29a7aa", "status": "affected", "versionType": "git" }, { "version": "194b3348bdbb7db65375c72f3f774aee4cc6614e", "lessThan": "22d169bdd2849fe6bd18c2643742e1c02be6451c", "status": "affected", "versionType": "git" }, { "version": "1b48c70feefc499b62670521efa002ab01e05df5", "status": "affected", "versionType": "git" }, { "version": "bc348a6cc8f92e9979fbfbb3c6b48fd51b4b1dbf", "status": "affected", "versionType": "git" }, { "version": "5.10.175", "lessThan": "5.10.252", "status": "affected", "versionType": "semver" }, { "version": "5.15.103", "lessThan": "5.15.202", "status": "affected", "versionType": "semver" }, { "version": "6.1.16", "lessThan": "6.1.165", "status": "affected", "versionType": "semver" }, { "version": "5.4.237", "lessThan": "5.5", "status": "affected", "versionType": "semver" }, { "version": "6.2.3", "lessThan": "6.3", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/iommu/intel/pasid.c" ], "versions": [ { "version": "6.3", "status": "affected" }, { "version": "0", "lessThan": "6.3", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.252", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.202", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.165", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.128", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.75", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.14", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.19.4", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.175", "versionEndExcluding": "5.10.252" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.103", "versionEndExcluding": "5.15.202" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.16", "versionEndExcluding": "6.1.165" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.6.128" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.12.75" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.18.14" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.19.4" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "7.0" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4.237" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2.3" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/cd75e77125c8a51754ca4cd60b4ca083ed735d1d" }, { "url": "https://git.kernel.org/stable/c/0616137b70e6d9a547d4b60df8e1b64e36d83661" }, { "url": "https://git.kernel.org/stable/c/36990407cdd257473607e33802d00e978af2759e" }, { "url": "https://git.kernel.org/stable/c/c93f23375d8c410954b0df825e814b632fd62b9d" }, { "url": "https://git.kernel.org/stable/c/5962c30a6f05ea1ab73f039e235bb30716243517" }, { "url": "https://git.kernel.org/stable/c/36244dfd3853f7bf89d03b8e90d56b23ce7fbc16" }, { "url": "https://git.kernel.org/stable/c/d15cda135148ea7ba929cfdbcf208182bc29a7aa" }, { "url": "https://git.kernel.org/stable/c/22d169bdd2849fe6bd18c2643742e1c02be6451c" } ], "title": "iommu/vt-d: Flush cache for PASID table before using it", "x_generator": { "engine": "bippy-1.2.0" } } } }