CVE-2026-90243
High · 8.1CVSS
8.1
EPSS
0.2%
Published
Sep 17, 2026
CISA due date
—
Cloudanix analysis
A bug in how the system handles certain hardware settings for device access could let errors happen during updates, possibly causing crashes or odd behavior on affected computers.
- Exploitation
- Local Privilege
- Attacker needs
- Local User
- Complexity
- High
- Impact
- Full Compromise
- Component
- OS kernel
- Class
- Race Condition
- Remediation
- Patch
- Effort
- Medium
- Patch risk
- Low
What it actually does
The vulnerability allows hardware to fetch a partially zeroed context entry while the Present bit remains set due to non-atomic writes and missing cacheline flush, leading to unpredictable IOMMU behavior or faults.
Why it matters to the business
May cause system instability, unexpected faults, or potential security bypasses in Linux systems using Intel VT-d IOMMU for device isolation.
How an attack unfolds
An attacker with local access triggers concurrent context entry modifications during tear-down, exploiting the window where the entry is torn but Present is set, potentially causing IOMMU misbehavior.
How to fix it
Apply the kernel patch that clears the Present bit first, flushes it, performs invalidations, then zeroes the rest of the entry.
How to confirm the fix worked
Verify the presence of the fix in the iommu/vt-d code by checking for context_clear_entry modifications following the VT-d spec handshake.
Typical attack path
- Identify a system using IOMMU with VT-d
- Trigger context entry copy and tear-down operations concurrently
- Exploit the race to have hardware fetch torn entry
How to detect it
Look for logs indicating spurious IOMMU faults or unpredictable device behavior around context invalidations; check dmesg for related errors.
What your security team should do
- Update Linux kernel to patched version
- Monitor for IOMMU-related faults
- Test in staging environments before deployment
The record
In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clear Present bit before tearing down copied context entry copied_context_tear_down() zeroes the 128-bit context entry with context_clear_entry() while the Present bit is still set, and only then issues the context-cache and IOTLB invalidations. This leaves a window in which hardware can fetch a torn entry, with some fields already zeroed while Present is still set, leading to unpredictable behaviour or spurious faults. While x86 provides strong write ordering, the compiler may reorder the writes to the two 64-bit halves of the entry, and the hardware fetch is not guaranteed to be atomic with respect to multiple CPU writes. There is no cacheline flush before the invalidation either, so on an IOMMU without coherent access to the context table the zeroed entry may not be visible to hardware at the point the invalidation is submitted. Apply the same ownership handshake described in the VT-d spec, Section 6.5.3.3 ("Guidance to Software for Invalidations"): clear only the Present bit, flush it out to the IOMMU, perform the invalidations, and only then zero the remainder of the entry.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|