CVE-2026-90240: iommu/vt-d: Flush context cache with correct SID when tearing down aliases
In the Linux kernel, the following vulnerability has been resolved:
iommu/vt-d: Flush context cache with correct SID when tearing down aliases
domaincontextclearone() and devicepasidtableteardown() are both invoked once per DMA alias of a device. Each function locates the context entry using the bus/devfn pair provided by the pciforeachdmaalias() callback, then calls intelcontextflushnopasid(), which constructs a device-selective context-cache invalidation from info->bus and info->devfn (that is, always the requester ID of the device itself).
As a result, for every alias other than the device’s own RID, the context entry that was just cleared in memory is never invalidated in the context cache. Hardware may continue using that stale cached entry. In the scalable-mode teardown path, intelpasidfreetable() can then free the PASID directory still referenced by that stale entry, allowing the IOMMU to walk freed memory.
Fix this by passing the source ID of the entry being torn down to intelcontextflushnopasid(), instead of deriving it from @info.
Affected Software
Event History
Frequently Asked Questions
Which Linux systems are exposed to the freed-memory IOMMU walk scenario?
The described freed-memory walk occurs in the Intel VT-d scalable-mode teardown path when a device has DMA aliases. Alias context entries can remain stale in the IOMMU context cache after being cleared in memory.
Is the issue limited to the device's primary requester ID?
No. The flaw affects DMA aliases other than the device's own requester ID, because the invalidation was issued using the device's requester ID rather than the source ID of the alias entry being removed.