Linux iommu/vt-d: context entry zeroed while Present, letting hardware fetch a torn entry

Impact

When tearing down a context entry copied from a previous kernel (the kexec/handoff path), the kernel zeroed the whole 128-bit entry while the Present bit was still set and only then invalidated the caches, with no cacheline flush before the invalidation. The IOMMU can fetch a half-zeroed but still-Present entry, giving unpredictable translation behaviour or spurious DMA faults; on an IOMMU without coherent context-table access the zeroing may not even be visible when the invalidation is submitted. The fix applies the VT-d spec's ownership handshake - clear Present, flush, invalidate, then zero. This is a separate defect from CVE-2026-90241 with its own commits: that one frees a referenced PASID table, this one races hardware on entry ordering. Practical exposure is the device-isolation boundary during kexec-based host handoff, which is how some operators update a node without a cold boot.

Who can reach it

Local, no privileges but high attack complexity (AV:L/AC:H/PR:N) - triggering it requires hitting the hardware fetch window during copied-context teardown. Not a remote or tenant-driven path.

What to do

Take the stable-kernel fix (four stable commits listed) through your distribution and reboot affected hosts. Only systems using Intel VT-d with copied/handoff context tables are in the path. No fixed userspace knob exists; schedule it with other kernel work on a drain-and-reboot cycle.

References

Related entries

• Linux kernel nfsd: unserialized grace_ended flag lets two contexts double-free every client reclaim recordCVE-2026-93221 · Linux kernel nfsd (nfsd_net grace_ended flag, nfsd4_end_grace race)High
• Apache MINA SSHD: a server requiring two public keys accepts the same key twice, a partial auth bypassCVE-2026-93994 · Apache MINA SSHD sshd-core (server-side multi-factor publickey authentication)High
• Linux kernel net/rds: teardown samples RDS_IN_XMIT instead of owning it, racing the transmit path into freed ring stateCVE-2026-98069 · Linux kernel net/rds (connection teardown vs transmit/refill fastpath locking)High
• Linux kernel IB/isert: deferred control PDU completions can run against a freed connection on teardownCVE-2026-98357 · Linux kernel IB/isert (iSER target, deferred control PDU completions vs connection teardown)High
• Linux kernel (virt/kvm): The dirty-ring reset path bounds-checks an offset with unchecked 64-bit arithmetic, so aCVE-2026-52969 · Linux kernel (virt/kvm)High
• Linux kernel KVM x86: rechecking L1 I/O intercepts on userspace exit completion leaves pio.count non-zeroCVE-2025-40026 · Linux kernel KVM x86 (I/O emulation completion rechecks L1 intercepts)High