Linux kernel (drivers/iommu/intel): The 512-bit VT-d PASID entry is zeroed all at once while still marked present, and

Impact

The 512-bit VT-d PASID entry is zeroed all at once while still marked present, and the hardware fetches it in several bursts, so the IOMMU can read a mixture of live and cleared fields. A device's PASID context - the thing that decides which address space its DMA lands in - is momentarily undefined while the device is still issuing traffic.

Who can reach it

Runs on PASID teardown: a tenant detaching an SVA context or releasing a PASID-attached device through /dev/vfio/* or /dev/iommu. Conditional on VT-d scalable mode with PASID; the race is between the CPU's zeroing writes and a hardware fetch driven by the tenant's own in-flight DMA, so the attacker controls one side of it. No host root.

What to do

Update to a stable kernel carrying commits a84d30e8 / 821807c1. Interim: stop tenant DMA before tearing down a PASID context, and disable scalable mode/PASID on nodes that do not need SVA.

References