Database/Kernel, userspace & hypervisor
Linux kernel (drivers/iommu/intel): On VT-d scalable mode with VMD enabled, RID2PASID setup fails for devices behind
Impact
On VT-d scalable mode with VMD enabled, RID2PASID setup fails for devices behind the VMD bridge, the device fails to join its IOMMU group, and the failure path adds the device info to a list it is already on. The result is a kernel BUG and a panic during boot or PCI enumeration. Practically this means a node configured for both NVMe VMD and the scalable-mode IOMMU that passthrough needs does not stay up - and scalable mode is exactly what you enable to do PASID-based device assignment.
Who can reach it
Not tenant-reachable. Triggered by host configuration: Intel VT-d in scalable mode plus VMD enabled in BIOS, on Sapphire Rapids class platforms. The panic happens during device enumeration, so it hits at boot or on PCI rescan, and needs host/firmware-level access to set up. Worth tracking because it is the combination a GPU node with NVMe VMD and PASID passthrough naturally lands on.
What to do
Fixed in 5.13 / 5.14 per this record; run a kernel at or beyond those on Intel nodes, or apply the linked stable commits. Interim: do not enable VMD and IOMMU scalable mode together on the same host - disable VMD in BIOS on nodes that need scalable-mode passthrough.
References
Related entries
- Linux kernel (drivers/iommu/intel): The VT-d scalable-mode context entry is zeroed while its Present bit is still setCVE-2026-74439 · Linux kernel (drivers/iommu/intel)Critical
- Linux kernel (drivers/iommu/intel): The VT-d I/O page-fault reporting path looks up the faulting device with noCVE-2024-35843 · Linux kernel (drivers/iommu/intel)High
- Linux kernel (drivers/iommu/intel): Use-after-free of VT-d cache-tag objects. Device-TLB cache tags outlive the IOMMUCVE-2024-56669 · Linux kernel (drivers/iommu/intel)High
- Linux kernel (drivers/iommu/intel): VT-d switched from set-and-check to clear-and-reset when programming device-tableCVE-2025-38216 · Linux kernel (drivers/iommu/intel)High
- Linux kernel (drivers/iommu/intel): VT-d advertised IOMMU dirty-page tracking on units whose page walk is not coherentCVE-2025-40058 · Linux kernel (drivers/iommu/intel)High
- Linux kernel (drivers/iommu/intel): A live 512-bit VT-d PASID entry is replaced with a single structure copy, so theCVE-2026-45945 · Linux kernel (drivers/iommu/intel)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.