{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-45944", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-13T15:03:33.087Z", "datePublished": "2026-05-27T12:18:00.481Z", "dateUpdated": "2026-08-05T12:28:51.029Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:28:51.029Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: Clear Present bit before tearing down context entry\n\nWhen tearing down a context entry, the current implementation zeros the\nentire 128-bit entry using multiple 64-bit writes. This creates a window\nwhere the hardware can fetch a \"torn\" entry — where some fields are\nalready zeroed while the 'Present' bit is still set — leading to\nunpredictable behavior or spurious faults.\n\nWhile x86 provides strong write ordering, the compiler may reorder writes\nto the two 64-bit halves of the context entry. Even without compiler\nreordering, the hardware fetch is not guaranteed to be atomic with\nrespect to multiple CPU writes.\n\nAlign with the \"Guidance to Software for Invalidations\" in the VT-d spec\n(Section 6.5.3.3) by implementing the recommended ownership handshake:\n\n1. Clear only the 'Present' (P) bit of the context entry first to\n signal the transition of ownership from hardware to software.\n2. Use dma_wmb() to ensure the cleared bit is visible to the IOMMU.\n3. Perform the required cache and context-cache invalidation to ensure\n hardware no longer has cached references to the entry.\n4. Fully zero out the entry only after the invalidation is complete.\n\nAlso, add a dma_wmb() to context_set_present() to ensure the entry\nis fully initialized before the 'Present' bit becomes visible." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable setup/teardown paths are reached via local IOMMU domain management (VFIO/iommufd device assignment or sysfs driver bind/unbind); there is no network or adjacent-network path to this code.\nAC:H - Manifesting the torn-entry requires the IOMMU hardware to fetch the context entry in a microscopic window between the CPU writes and the cache/context-cache invalidation, combined with compiler/CPU write reordering — timing conditions the attacker cannot reliably control.\nPR:H - Driving an IOMMU context setup/teardown requires CAP_SYS_ADMIN-level privilege (VFIO/iommufd assignment or sysfs driver unbind), which is not obtainable through user namespaces.\nUI:N - The teardown/setup window is reached purely through IOMMU control operations with no victim action required.\nS:C - The IOMMU is the DMA isolation boundary; a torn/stale context entry lets a device's in-flight DMA be mistranslated and escape its assigned domain, impacting memory belonging to a different security authority (the host or another domain).\nC:H - A device using a stale/torn translation during the window can read host memory outside its intended domain across the IOMMU boundary, yielding a potential arbitrary device-driven read.\nI:H - The same cross-boundary mistranslation lets the device write host memory outside its domain, providing an arbitrary device-driven write primitive.\nA:H - The commit documents \"unpredictable behavior or spurious faults\"; torn-entry fetches generate DMAR fault storms and device/driver malfunction that can hang or crash the system." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/iommu/intel/iommu.c", "drivers/iommu/intel/iommu.h", "drivers/iommu/intel/pasid.c" ], "versions": [ { "version": "ba39592764ed20cee09aae5352e603a27bf56b0d", "lessThan": "c716a59e9977d751e5eb54bcfa6a80124cb5067b", "status": "affected", "versionType": "git" }, { "version": "ba39592764ed20cee09aae5352e603a27bf56b0d", "lessThan": "d2138abc8f0a7fce4101b7229b43b06811ed083d", "status": "affected", "versionType": "git" }, { "version": "ba39592764ed20cee09aae5352e603a27bf56b0d", "lessThan": "a922dbafb4a674d958d702038232d09a30daf770", "status": "affected", "versionType": "git" }, { "version": "ba39592764ed20cee09aae5352e603a27bf56b0d", "lessThan": "c1e4f1dccbe9d7656d1c6872ebeadb5992d0aaa2", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/iommu/intel/iommu.c", "drivers/iommu/intel/iommu.h", "drivers/iommu/intel/pasid.c" ], "versions": [ { "version": "2.6.24", "status": "affected" }, { "version": "0", "lessThan": "2.6.24", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.97", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.14", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.19.4", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.24", "versionEndExcluding": "6.12.97" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.24", "versionEndExcluding": "6.18.14" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.24", "versionEndExcluding": "6.19.4" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.24", "versionEndExcluding": "7.0" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/c716a59e9977d751e5eb54bcfa6a80124cb5067b" }, { "url": "https://git.kernel.org/stable/c/d2138abc8f0a7fce4101b7229b43b06811ed083d" }, { "url": "https://git.kernel.org/stable/c/a922dbafb4a674d958d702038232d09a30daf770" }, { "url": "https://git.kernel.org/stable/c/c1e4f1dccbe9d7656d1c6872ebeadb5992d0aaa2" } ], "title": "iommu/vt-d: Clear Present bit before tearing down context entry", "x_generator": { "engine": "bippy-1.2.0" } } } }