Linux kernel (drivers/iommu/intel): The 128-bit VT-d context entry is zeroed with multiple writes while its Present bit

Impact

The 128-bit VT-d context entry is zeroed with multiple writes while its Present bit is still set, so the IOMMU can fetch a torn entry - some fields already cleared, still marked present. The hardware then translates a device's DMA through a half-demolished context, which is undefined behaviour on the structure that binds a device to its tenant's address space.

Who can reach it

Runs on the device-context teardown path: unbinding a device from its domain, which happens when a tenant releases a passthrough device or the operator rebinds a card. Requires VT-d and a race between the CPU zeroing the entry and a hardware fetch, so it is timing-dependent - but the timing is driven by the tenant's own DMA traffic during teardown.

What to do

Update to a stable kernel carrying commits c716a59e / d2138abc. Interim: quiesce device DMA before releasing a passthrough device (stop the tenant workload, then unbind) rather than tearing down under active traffic.

References