Linux kernel (drivers/iommu/intel): A live 512-bit VT-d PASID entry is replaced with a single structure copy, so the

Impact

A live 512-bit VT-d PASID entry is replaced with a single structure copy, so the IOMMU can fetch a half-old, half-new entry and briefly translate through a page table that belongs to neither the old nor the new domain. Domain replacement is exactly what happens when a passthrough device is moved between address spaces or between tenants, which is where a torn entry turns into DMA against the wrong tenant's memory.

Who can reach it

Triggered on the domain-replacement path, which a tenant or its VMM drives through iommufd (attach/replace a HWPT) or through vfio device rebinding while the device is actively issuing DMA. Conditional on VT-d scalable mode with PASID; no host root. Timing-dependent, but the attacker controls both the replacement and the DMA traffic that races it.

What to do

Update to a stable kernel carrying commits 47180078 / 66a7aff4. Interim: quiesce the device (stop tenant DMA) around any domain attach/replace, and avoid runtime HWPT replacement for tenant devices on unpatched hosts.

References