Linux iommu/vt-d: stale context-cache entry on alias teardown lets the IOMMU walk freed PASID tables

Impact

When a PCI device with DMA aliases is torn down, the context entry for every alias other than the device's own requester ID is cleared in memory but never invalidated in the context cache, so the IOMMU may keep using the stale entry. In scalable mode, intel_pasid_free_table() can then free a PASID directory that the stale entry still references, leaving hardware walking freed memory - a use-after-free driven by DMA rather than by the CPU. On a GPU node this is the path that enforces isolation for passthrough: VFIO assignment of GPUs, NICs and NVMe to tenant VMs or containers repeatedly attaches and detaches devices, and a device that DMA-translates through freed page tables is a memory-corruption and cross-domain-access risk on the host. Exposure requires devices that report DMA aliases, which is common behind PCIe switches and bridges in dense accelerator chassis.

Who can reach it

Local privileged path: anything that attaches and detaches a device from an IOMMU domain - VFIO/passthrough assignment, device reset, driver unbind. A tenant holding a VFIO device through a passthrough workflow can drive repeated teardowns; unprivileged tenants without device-assignment rights cannot reach it.

What to do

Pick up the stable kernel containing the fix (pass the source ID of the entry being torn down to intel_context_flush_no_pasid) and reboot each affected node - no runtime mitigation, so this is a rolling drain-and-reboot across the fleet. Until then, avoid repeated attach/detach cycles of aliasing devices on Intel VT-d hosts in scalable mode.

References

Related entries

• Linux iommu/tegra241-cmdqv: multi-stream devices get incomplete vSID mapping, zero-stream devices read out of boundsCVE-2026-90425 · Linux kernel iommu/tegra241-cmdqv (vSID to Stream ID mapping)High
• Linux dw-edma: callbacks fire for terminated transfers, dereferencing freed client stateCVE-2026-93042 · Linux kernel dmaengine dw-edma (terminate-all descriptor handling)High
• QEMU 9pfs: use-after-free race between Tlcreate and Twalk lets a guest escape the shared directory to host filesCVE-2026-93834 · QEMU 9pfs (virtio-9p shared directory, Tlcreate/Twalk race)High
• Linux kernel nvme-fc: error recovery iterates an uninitialized IO tagset when admin connect times outCVE-2026-97409 · Linux kernel nvme-fc (requests cancelled in an uninitialized IO tagset during CONNECTING error recovery)High
• Linux kernel qla2xxx: unserialized NVMe-FC unsolicited-context list can be corrupted by concurrent add and deleteCVE-2026-97527 · Linux kernel scsi qla2xxx (fcport->unsol_ctx_head list unserialized across ISR, DPC and NVMe-FC callbacks)High
• Linux kernel qla2xxx: NVMe-FC unsolicited context freed while still linked, leaving a freed node on the listCVE-2026-97528 · Linux kernel scsi qla2xxx (uctx freed without list_del() on qla_nvme_xmt_ls_rsp() error path)High