CVE-2026-43220 Overview
CVE-2026-43220 is a race condition in the AMD Input/Output Memory Management Unit (IOMMU) driver within the Linux kernel. The flaw exists in the Translation Lookaside Buffer (TLB) invalidation path, where the cmd_sem_val sequence counter was incremented outside the IOMMU spinlock. Under concurrent TLB invalidations, this allowed CMD_COMPL_WAIT commands to be queued out of sequence, breaking the ordering assumption in wait_on_sem() and causing completion waits to time out randomly. The kernel maintainers resolved the issue by moving the cmd_sem_val increment under iommu->lock to serialize sequence allocation with command queuing.
Critical Impact
Concurrent TLB invalidations can produce sporadic completion-wait timeouts that destabilize systems relying on AMD IOMMU, including virtualization hosts and DMA-protected workloads.
Affected Products
- Linux kernel builds containing the AMD IOMMU driver prior to the fix
- Systems using AMD platforms with IOMMU enabled for DMA remapping or virtualization
- Kernel branches tracked by the stable commits referenced in the upstream advisory
Discovery Timeline
- 2026-05-06 - CVE-2026-43220 published to NVD
- 2026-05-06 - Last updated in NVD database
Technical Details for CVE-2026-43220
Vulnerability Analysis
The AMD IOMMU driver uses a command queue to issue invalidation requests to the hardware. Each CMD_COMPL_WAIT command carries a sequence value drawn from cmd_sem_val, and the driver later calls wait_on_sem() to confirm the hardware has reached that sequence. Correct operation depends on the sequence number assigned to a command matching the order in which the command is appended to the queue.
The driver incremented cmd_sem_val outside of iommu->lock, which guards command queue insertion. When two CPUs issued TLB invalidations concurrently, one thread could obtain a sequence value, get preempted, and have its command enqueued after a second thread that obtained a later sequence value. The hardware then signaled completion in queue order, while the waiter expected its specific sequence number, leading to spurious timeouts.
Root Cause
The root cause is an atomicity violation between sequence number allocation and command queue insertion. Two operations that must be observed as a single atomic step were performed under different synchronization scopes, producing a classic race condition between concurrent producers of IOMMU commands.
Attack Vector
This is a kernel reliability defect rather than a memory-safety flaw. Concurrent IOMMU consumers, such as drivers performing DMA unmaps, virtualization workloads, or device hot-path operations, trigger the race naturally under load. The observed effect is a completion-wait timeout, which the AMD IOMMU driver treats as a fatal condition. Refer to the upstream commits for the precise patch hunks: stable commit 9e249c4, stable commit 5000ce7, and stable commit 48caa75.
Detection Methods for CVE-2026-43220
Indicators of Compromise
- Kernel log messages reporting completion-wait timeout or CMD_COMPL_WAIT failures from the amd_iommu subsystem
- Sporadic device DMA stalls or iommu fault entries appearing during periods of high concurrent IO
- Virtual machine guests reporting passthrough device hangs on AMD hosts running unpatched kernels
Detection Strategies
- Inventory running Linux kernel versions across AMD-based fleets and compare against the fixed stable branches referenced in the upstream commits
- Aggregate dmesg and journald output centrally and alert on AMD IOMMU completion-wait errors
- Track host stability metrics for virtualization clusters, correlating reboots and device resets with IOMMU log entries
Monitoring Recommendations
- Forward kernel ring buffer events to a centralized logging pipeline for long-term analysis
- Monitor frequency of iommu related errors per host and trend over time to detect regression after kernel updates
- Validate package versions on AMD EPYC and Ryzen hosts during routine compliance scans
How to Mitigate CVE-2026-43220
Immediate Actions Required
- Apply the latest stable Linux kernel update for your distribution that includes the upstream fix moving cmd_sem_val increment under iommu->lock
- Prioritize patching virtualization hosts and systems with PCIe device passthrough on AMD platforms
- Reboot affected systems after package installation to load the corrected kernel image
Patch Information
The fix is committed upstream in the Linux kernel. Reference the stable tree commits at git.kernel.org commit 9e249c4, git.kernel.org commit 5000ce7, and git.kernel.org commit 48caa75. Distribution vendors backport these changes into their supported kernel streams.
Workarounds
- No supported workaround replaces the patch; disabling AMD IOMMU is not advisable on systems relying on it for DMA isolation or virtualization
- Reduce concurrent TLB invalidation pressure by limiting parallel device hot-plug or large DMA-unmap workloads until patching is complete
- Schedule maintenance windows to deploy fixed kernels and validate stability under representative workloads
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
