Cloudanix VulnDB

CVE-2026-90240

High · 8.8

CVSS

8.8

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel's handling of certain hardware memory settings could let someone with access to the machine cause crashes or take control of the system.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Medium

What it actually does

Incorrect SID passed to context cache invalidation during alias teardown leaves stale IOMMU context entries; in scalable mode the referenced PASID directory can be freed while hardware still walks it, producing a use-after-free.

Why it matters to the business

Systems using Intel VT-d IOMMU in scalable mode may experience kernel memory corruption, crashes, or local privilege escalation, risking workload disruption and data integrity on servers and endpoints with multiple DMA aliases.

How an attack unfolds

An attacker with local access triggers repeated attach/detach or device teardown operations on a device that has DMA aliases; the missing cache flush allows the IOMMU to continue using a freed PASID table, turning the UAF into arbitrary memory access or denial of service.

How to fix it

Update to a Linux kernel containing the fix that passes the correct source ID to intel_context_flush_no_pasid; rebuild and reboot with the patched kernel. Where immediate patching is impossible, disable scalable mode or limit IOMMU usage if hardware permits.

How to confirm the fix worked

Confirm the running kernel contains the commit that modifies intel_context_flush_no_pasid to receive the teardown SID; inspect dmesg or IOMMU debug output for correct SID values during alias teardown; re-test device attach/detach sequences under load.

Typical attack path

  1. Obtain local code execution on a Linux host with Intel IOMMU enabled in scalable mode
  2. Identify or create a PCI device that reports DMA aliases via pci_for_each_dma_alias
  3. Trigger domain teardown paths (domain_context_clear_one or device_pasid_table_teardown) for those aliases
  4. Force intel_pasid_free_table to release memory still referenced by the stale context-cache entry
  5. Leverage the resulting UAF for memory corruption or crash

How to detect it

Review kernel logs for IOMMU or VT-d errors around device teardown events; look for unexpected page faults or warnings from intel-iommu; correlate with processes performing frequent PCI device attach/detach; no reliable post-exploitation artifacts are publicly documented.

What your security team should do

  • Prioritize kernel updates on all Intel VT-d hosts within the next maintenance window
  • Audit workloads that rely on IOMMU scalable mode or SR-IOV devices
  • Monitor vendor advisories for backported fixes in distribution kernels
  • Consider temporary mitigation by disabling scalable mode where functional impact is acceptable

The record

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Flush context cache with correct SID when tearing down aliases domain_context_clear_one() and device_pasid_table_teardown() are both invoked once per DMA alias of a device. Each function locates the context entry using the bus/devfn pair provided by the pci_for_each_dma_alias() callback, then calls intel_context_flush_no_pasid(), which constructs a device-selective context-cache invalidation from info->bus and info->devfn (that is, always the requester ID of the device itself). As a result, for every alias other than the device’s own RID, the context entry that was just cleared in memory is never invalidated in the context cache. Hardware may continue using that stale cached entry. In the scalable-mode teardown path, intel_pasid_free_table() can then free the PASID directory still referenced by that stale entry, allowing the IOMMU to walk freed memory. Fix this by passing the source ID of the entry being torn down to intel_context_flush_no_pasid(), instead of deriving it from @info.

Affected packages

Ecosystem Package Introduced Fixed