Linux kernel (drivers/iommu/intel): The 128-bit VT-d context entry is zeroed with multiple writes while its Present bit

CVSS 7.5CVE-2026-45944Kernel, userspace & hypervisorcurated

Impact

The 128-bit VT-d context entry is zeroed with multiple writes while its Present bit is still set, so the IOMMU can fetch a torn entry - some fields already cleared, still marked present. The hardware then translates a device's DMA through a half-demolished context, which is undefined behaviour on the structure that binds a device to its tenant's address space.

Who can reach it

Runs on the device-context teardown path: unbinding a device from its domain, which happens when a tenant releases a passthrough device or the operator rebinds a card. Requires VT-d and a race between the CPU zeroing the entry and a hardware fetch, so it is timing-dependent - but the timing is driven by the tenant's own DMA traffic during teardown.

What to do

Update to a stable kernel carrying commits c716a59e / d2138abc. Interim: quiesce device DMA before releasing a passthrough device (stop the tenant workload, then unbind) rather than tearing down under active traffic.

References

https://git.kernel.org/stable/c/c716a59e9977d751e5eb54bcfa6a80124cb5067b https://git.kernel.org/stable/c/d2138abc8f0a7fce4101b7229b43b06811ed083d https://nvd.nist.gov/vuln/detail/CVE-2026-45944

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.