CVE-2026-43130: Linux Kernel IOMMU VT-d DoS Vulnerability

CVE-2026-43130 Overview

CVE-2026-43130 is a Linux kernel vulnerability in the Intel VT-d IOMMU driver (iommu/vt-d). The flaw causes a hard-lockup when the kernel issues a device IOTLB (dev-IOTLB) flush against a PCIe device whose link is down due to faults. A prior fix (commit 4fc82cd907ac) skipped Address Translation Service (ATS) invalidation only when pci_dev_is_disconnected() returned true, which does not cover fault-induced link-down conditions. Operations such as releasing a VFIO group file descriptor after virsh destroy can trigger qi_submit_sync against an unreachable device, hard-locking the host.

Critical Impact
A faulted PCIe device can hard-lock the host system during routine VFIO/IOMMU teardown paths, producing a denial-of-service condition on virtualization and GPUDirect RDMA hosts.

Affected Products

Linux kernel builds containing commit 4fc82cd907ac ("iommu/vt-d: Don't issue ATS Invalidation request when device is disconnected") prior to the fixes referenced in the kernel.org stable tree
Hosts using Intel VT-d scalable mode with PCIe devices supporting ATS
Virtualization and GPUDirect RDMA (GDR) deployments that pass PCIe devices through to guests via VFIO

Discovery Timeline

2026-05-06 - CVE-2026-43130 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43130

Vulnerability Analysis

The vulnerability resides in the Intel VT-d driver path that issues dev-IOTLB invalidations through qi_flush_dev_iotlb. When a PCIe device experiences a link-down due to faults (rather than an explicit hot-removal), pci_dev_is_disconnected() continues to return false. The driver therefore submits the ATS invalidation queue command to a device that cannot acknowledge it, blocking on the invalidation queue and producing a CPU hard-lockup.

The observed call trace originates from VFIO teardown: vfio_group_fops_release → vfio_iommu_type1_detach_group → __iommu_group_set_domain_internal → device_block_translation → intel_pasid_tear_down_entry → qi_flush_dev_iotlb → qi_submit_sync. The fix replaces the disconnect check with pci_device_is_present(), which performs a configuration-space probe and accurately reflects link state under fault conditions.

Root Cause

The root cause is incomplete reachability detection before issuing ATS invalidation [Kernel Vulnerability]. pci_dev_is_disconnected() only signals software-driven removal state and does not reflect hardware link-down caused by PCIe faults. Submitting an invalidation queue descriptor to an unreachable endpoint causes the synchronous wait in qi_submit_sync to never complete.

Attack Vector

Exploitation requires a PCIe device passed through to a guest (or otherwise managed via VFIO) entering a faulted link-down state. A guest workload that drives the device into a fault, followed by host-side cleanup such as virsh destroy, triggers the teardown path that calls devtlb_invalidation_with_pasid() against the faulted device. The condition is most reproducible under GDR high-load scenarios. The vulnerability is a denial-of-service issue rather than a code execution primitive.

The upstream fix swaps the reachability test in the dev-IOTLB flush path so that invalidation is skipped whenever pci_device_is_present() returns false. The added latency, approximately 70 µs on a ConnectX-5 at 8 GT/s x2, is bounded by infrequent call sites: mm-struct release, device attach/release, PASID set/remove, and dirty-tracking setup. See the kernel commit ead67d0 for the patch.

Detection Methods for CVE-2026-43130

Indicators of Compromise

Hard-lockup watchdog warnings on the host with stack frames containing qi_submit_sync, qi_flush_dev_iotlb, and intel_pasid_tear_down_entry
VFIO group release stalls (vfio_group_fops_release, __fput) coinciding with PCIe AER (Advanced Error Reporting) link-down events
Repeated DMAR or vt-d queue invalidation timeout messages in dmesg after guest shutdown via virsh destroy

Detection Strategies

Correlate PCIe AER fatal/non-fatal error messages with subsequent VFIO teardown operations on the same BDF (Bus:Device.Function)
Monitor kernel ring buffer for softlockup/hardlockup detector output referencing the IOMMU invalidation queue
Track libvirt domain destruction events that fail to release device resources within expected timeouts

Monitoring Recommendations

Forward kernel.dmesg, auditd, and libvirt logs to a central analytics platform and alert on co-occurrence of AER errors and VFIO release operations
Instrument host telemetry to capture CPU stall durations on cores handling QEMU/VFIO worker threads
Track passthrough device health via lspci -vvv and PCIe link status registers on hosts running GDR or SR-IOV workloads

How to Mitigate CVE-2026-43130

Immediate Actions Required

Apply the Linux stable kernel update containing the iommu/vt-d fix that uses pci_device_is_present() in the dev-IOTLB flush path
Inventory hosts running Intel VT-d scalable mode with PCIe passthrough and prioritize patching of virtualization and GDR systems
Avoid forcing virsh destroy against guests with faulted PCIe devices on unpatched hosts until kernels are updated

Patch Information

The fix has been merged into the kernel stable tree across multiple branches. Reference commits include 01aed2f, 0da6697, 10e60d8, 581ce09, 9813306, 9deaacc, e2c78c6, and ead67d0. Distribution maintainers should backport these commits to LTS kernels shipped with hypervisor platforms.

Workarounds

Where patching is delayed, disable VT-d scalable mode or avoid passthrough of devices prone to link-down faults
Replace forceful guest termination with controlled shutdown sequences that quiesce device I/O before VFIO group release
Enforce PCIe AER policies that surface link-down conditions to operators before initiating IOMMU teardown

bash

# Verify the running kernel includes the fix by checking for the stable commit
uname -r
git -C /usr/src/linux log --oneline | grep -E 'ead67d0|9813306|01aed2f'

# Confirm Intel VT-d and scalable mode status
dmesg | grep -i 'DMAR\|vt-d\|scalable mode'

# List PCIe devices bound to vfio-pci for passthrough auditing
lspci -nnk | grep -A3 vfio-pci