Linux iommu/vt-d: probe failure frees a PASID table still referenced by live context entries

Impact

On Intel IOMMUs in scalable mode, setting up a device with DMA aliases programs a context entry per RID. If the walk fails partway, the probe error path frees the PASID table without first tearing down the context entries already pointing at it, leaving the IOMMU able to walk a Present context entry whose PASID table pointer references freed memory. That is a use-after-free reached by hardware DMA translation, on exactly the machinery that isolates PCIe devices - the same mechanism GPU and NIC passthrough depends on. Reaching it requires a device probe failure, so this is a robustness and isolation fix rather than something a tenant drives directly; the record scores it local with high privileges and a scope change.

Who can reach it

Local, high privilege (AV:L/PR:H) - the actor needs to be able to drive device probe/attach on the host, i.e. host root or an equivalently privileged path. Not reachable from inside a guest or a container without device-management rights.

What to do

Pick up the fix from your distribution's stable kernel (four stable commits are listed) and reboot each affected host; there is no runtime mitigation for an IOMMU teardown-ordering bug. Hosts that do not use Intel VT-d scalable mode are not affected. On GPU nodes this is a drain-and-reboot item that can ride the next kernel maintenance window rather than an emergency.

References

Related entries

• Linux kernel NVMe driver (FDP configurations log parsing): While walking the Flexible Data Placement configurationsCVE-2026-97433 · Linux kernel NVMe driver (FDP configurations log parsing)High
• Linux kernel x86/mm/pat: split page tables bypass kernel page table tracking, leaving stale IOTLB entries after freeCVE-2026-97525 · Linux kernel x86 CPA/PAT (__split_large_page kernel page table allocation)High
• libcurl: use-after-free when a TLS 1.3 session ticket arrives on a reused connectionCVE-2021-22901 · curl / libcurl (OpenSSL TLS 1.3 session ticket handling)High
• Linux kernel (net/tls): When a NIC with active kTLS offload goes down, the offload teardown freed the TLS context whileCVE-2021-47131 · Linux kernel (net/tls)High
• VMware ESXi / Workstation / Fusion (storage controller out-of-bounds read/write): A malicious actor inside a VMCVE-2024-22273 · VMware ESXi / Workstation / Fusion (storage controller out-of-bounds read/write)High
• Linux kernel (net/xfrm): The error path of xfrm_input leaves the secpath entry pointing at poisoned memory, and theCVE-2024-43878 · Linux kernel (net/xfrm)High