CVE-2026-90243: iommu/vt-d: Clear Present bit before tearing down copied context entry
In the Linux kernel, the following vulnerability has been resolved:
iommu/vt-d: Clear Present bit before tearing down copied context entry
copiedcontextteardown() zeroes the 128-bit context entry with contextclearentry() while the Present bit is still set, and only then issues the context-cache and IOTLB invalidations. This leaves a window in which hardware can fetch a torn entry, with some fields already zeroed while Present is still set, leading to unpredictable behaviour or spurious faults. While x86 provides strong write ordering, the compiler may reorder the writes to the two 64-bit halves of the entry, and the hardware fetch is not guaranteed to be atomic with respect to multiple CPU writes.
There is no cacheline flush before the invalidation either, so on an IOMMU without coherent access to the context table the zeroed entry may not be visible to hardware at the point the invalidation is submitted.
Apply the same ownership handshake described in the VT-d spec, Section 6.5.3.3 ("Guidance to Software for Invalidations"): clear only the Present bit, flush it out to the IOMMU, perform the invalidations, and only then zero the remainder of the entry.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In the iommu/vt-d path, when tearing down a copied context entry, clear the Present bit first (using context_clear_entry() while Present is still set), then issue the context-cache and IOTLB invalidations. After invalidations are issued, zero the remainder of the 128-bit context entry (via copied_context_tear_down()). This avoids a window where hardware may fetch a torn entry with some fields already zeroed.
Linux kernel (iommu/vt-d) Present bit handling for copied context entry invalidation = Clear Present bit before tearing down copied context entry (and perform remaining zeroing/invalidation after Present is cleared)