Linux kernel (drivers/iommu/intel): The VT-d scalable-mode context entry is zeroed while its Present bit is still set

Impact

The VT-d scalable-mode context entry is zeroed while its Present bit is still set, and the PASID directory pages are freed before the IOMMU is told to stop using them. The hardware can keep walking a live-looking entry into memory the kernel has already reallocated, so a tenant's device DMAs into arbitrary reused host memory - a direct tenant-to-host DMA escape, not just a crash.

Who can reach it

Reached on the normal teardown path whenever a passthrough device with a scalable-mode PASID table is released - a tenant closing its /dev/vfio/* device fd, or a VM exiting, is enough to run device_pasid_table_teardown(). Requires VT-d scalable mode (the default on modern Intel platforms with PASID/SVA); no host root.

What to do

Update to a stable kernel carrying commits e9e83bcf / 58871810. The CNA's fixed-version data for this record is not usable as a version target, so verify the commits are in your distro kernel. Interim: disable VT-d scalable mode / PASID (intel_iommu=sm_off) on nodes that hand devices to tenants, accepting the loss of SVA.

References