Linux iommu/vt-d (dev-IOTLB flush for passed-through PCIe devices): The Intel IOMMU driver skips device-IOTLB

Impact

The Intel IOMMU driver skips device-IOTLB invalidation for PCIe endpoints that are ATS-enabled and passed through to userspace — the exact configuration used for SR-IOV NIC VFs handed to a VM, and for DPDK and RDMA userspace drivers on a GPU node. The device-IOTLB is the device's own cached copy of the address translations; if it is not flushed when a mapping is revoked, the device can keep reaching memory the kernel believes it has taken away. That is the core mechanism DMA isolation depends on, and passthrough NICs are precisely the devices you hand to untrusted tenants. Companion issue CVE-2026-43130 covers the scalable-mode variant.

Who can reach it

A tenant holding a passed-through, ATS-enabled PCIe device — an SR-IOV VF assigned to their VM, or a DPDK/RDMA userspace-bound NIC — able to exercise the device after a mapping has been torn down.

What to do

Kernel upgrade plus host reboot — rolling across every node that does device passthrough, which on a GPU cloud is all of them. Nothing to flash. If you cannot patch immediately, the meaningful mitigation is disabling ATS on passed-through endpoints (a BIOS/kernel-parameter change, at a measurable performance cost) or not passing devices through to untrusted tenants at all.

References

Related entries

• Linux kernel CephFS client: stale xattr blob size hits a BUG_ON and panics the nodeCVE-2026-52961 · Linux kernel CephFS client (__ceph_build_xattrs_blob)Medium
• Linux amd-pstate - memory leak in amd_pstate_epp_cpu_init(): On failure to set the energy-performance preferenceCVE-2026-53121 · Linux amd-pstate - memory leak in amd_pstate_epp_cpu_init()Medium
• Linux iommu/amd - devid bounds check in __rlookup_amd_iommu(): The AMD IOMMU driver looked up device IDs withoutCVE-2026-53283 · Linux iommu/amd - devid bounds check in __rlookup_amd_iommu()Medium
• Linuxfabrik monitoring plugins: sudo-authorized checks read arbitrary root-readable files via --testCVE-2026-73974 · Linuxfabrik Monitoring Plugins / linuxfabrik-lib (lib.lftest.test --test path handling)Medium
• community.general ipa_getkeytab: IPA/LDAP bind password written to logs and exposed in the process listCVE-2026-80158 · Ansible community.general ipa_getkeytab module (bind_pw not declared no_log)Medium
• Harbor (audit log redaction, LDAP password and OIDC client secret): CREDENTIAL DISCLOSURE VIA THE AUDIT TRAIL: HarborNCVD-2026-058-harbor-audit-log-redaction-ldap · Harbor (audit log redaction, LDAP password and OIDC client secret)Medium