CVE-2026-90243: iommu/vt-d: Clear Present bit before tearing down copied context entry
In the Linux kernel, the following vulnerability has been resolved:
iommu/vt-d: Clear Present bit before tearing down copied context entry
copiedcontextteardown() zeroes the 128-bit context entry with contextclearentry() while the Present bit is still set, and only then issues the context-cache and IOTLB invalidations. This leaves a window in which hardware can fetch a torn entry, with some fields already zeroed while Present is still set, leading to unpredictable behaviour or spurious faults. While x86 provides strong write ordering, the compiler may reorder the writes to the two 64-bit halves of the entry, and the hardware fetch is not guaranteed to be atomic with respect to multiple CPU writes.
There is no cacheline flush before the invalidation either, so on an IOMMU without coherent access to the context table the zeroed entry may not be visible to hardware at the point the invalidation is submitted.
Apply the same ownership handshake described in the VT-d spec, Section 6.5.3.3 ("Guidance to Software for Invalidations"): clear only the Present bit, flush it out to the IOMMU, perform the invalidations, and only then zero the remainder of the entry.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In Linux kernel iommu/vt-d copied_context_tear_down(), clear only the context entry's Present bit, flush the change to the IOMMU, perform the context-cache and IOTLB invalidations, and then zero the remainder of the 128-bit entry.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel's Intel VT-d IOMMU context-entry teardown path are exposed. The issue is particularly relevant during teardown of copied context entries, where hardware may observe a partially cleared entry.
What conditions are needed to trigger the problem?
The affected teardown operation must occur while the IOMMU can fetch the context entry. Exploitation or manifestation depends on a timing window in which the Present bit remains set while other portions of the 128-bit entry have been cleared or are not yet visible to the IOMMU.
What is the risk if it occurs?
The IOMMU may consume a torn context entry whose fields are inconsistent despite its Present bit being set. This can result in unpredictable behavior or spurious faults.
What is the required mitigation when applying the fix?
Use the corrected teardown sequence: clear only the Present bit, make that change visible to the IOMMU, perform context-cache and IOTLB invalidations, and then clear the rest of the context entry. This follows the ownership handshake described in the VT-d specification.