CVE-2026-89448: iommu/vt-d: Force requesting ACS when tboot is enabled
In the Linux kernel, the following vulnerability has been resolved:
iommu/vt-d: Force requesting ACS when tboot is enabled
Currently the conditions of requesting ACS in detectinteliommu() don't include tboot, leading to a possible misconfiguration with ACS disabled (e.g. due to user opts) while iommu is later forced on by tbootforceiommu().
Fix it by checking tboot in detectinteliommu().
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In detect_intel_iommu(), check whether tboot is enabled and, when it is, force requesting ACS (as done by iommu/vt-d via tboot_force_iommu()), to avoid misconfiguration from excluding tboot in ACS request logic.
Linux kernel (detect_intel_iommu / iommu/vt-d) Force requesting ACS when tboot is enabled (tboot_force_iommu()) = enabled
Event History
Frequently Asked Questions
Which systems are exposed to this misconfiguration?
Systems using Intel VT-d with tboot enabled are affected when ACS is disabled, including when it has been disabled through user-provided options. The issue arises because tboot later forces the IOMMU on without ACS having been requested during detection.
What configuration change addresses the issue if an update cannot be applied immediately?
Ensure ACS is not disabled when tboot is enabled and Intel VT-d is in use. The resolved behavior requests ACS during Intel IOMMU detection whenever tboot is enabled.