Linux kernel (drivers/iommu/intel): A device that does not support ATS never gets inserted into the VT-d device

CVSS 8.2CVE-2026-74355Kernel, userspace & hypervisorcurated

Impact

A device that does not support ATS never gets inserted into the VT-d device red-black tree, but a later probe failure still runs the removal, which treats the zeroed node as a tree root and corrupts the tree. That tree is what maps an incoming device request back to its device context, so corrupting it means faults and ATS lookups can resolve to the wrong device - and the corruption itself is an out-of-bounds write into kernel memory.

Who can reach it

Requires a probe failure on a device behind VT-d, so the trigger is host-side: driver binding during boot or during passthrough provisioning, on a device without ATS support where a later probe step fails. Not tenant-driven, but the damaged structure is shared by every device on the IOMMU, so the fallout lands on tenant devices.

What to do

Update to a stable kernel carrying commits f5102e0f / d16923a4. Interim: watch for probe failures in the VT-d path during node bring-up and refuse to schedule tenants onto a node that logged one until it is rebooted.

References

https://git.kernel.org/stable/c/f5102e0fc3c6dc8685549891a96e4589fdb3e211 https://git.kernel.org/stable/c/d16923a45d4d08367650fdc3451c89299ab6ac5a https://nvd.nist.gov/vuln/detail/CVE-2026-74355

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.