CVE-2026-45862 Overview
CVE-2026-45862 is a Linux kernel vulnerability in the Intel VT-d IOMMU driver (iommu/vt-d). The flaw involves an ordering issue when writing a freshly allocated PASID (Process Address Space ID) table address to a PASID directory entry. The CPU cache flush for the PASID table occurred after the directory entry write rather than before it. This created a time window where non-coherent IOMMU hardware could read uninitialized memory from RAM instead of the expected zero-initialized values. The vulnerability has been resolved in the upstream Linux kernel through multiple stable backport commits.
Critical Impact
Non-coherent IOMMU hardware may consume stale, uninitialized RAM contents as PASID table entries, potentially leading to undefined DMA translation behavior on Intel VT-d systems.
Affected Products
- Linux kernel with Intel VT-d IOMMU driver enabled
- Systems using non-coherent IOMMU hardware with PASID support
- Multiple stable kernel branches (see referenced upstream commits)
Discovery Timeline
- 2026-05-27 - CVE-2026-45862 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-45862
Vulnerability Analysis
The vulnerability resides in the Intel VT-d IOMMU driver's PASID table initialization sequence. When a new PASID table is allocated, the driver zero-initializes the table in RAM, writes its address into a PASID directory entry, and flushes the CPU cache so the IOMMU sees current data. The original code performed these steps in the wrong order. The directory entry was published to hardware before the CPU cache flush completed, allowing non-coherent IOMMU hardware to observe stale RAM contents during a small window.
This is a memory initialization ordering defect affecting hardware-software coherency. On systems where the IOMMU is not coherent with CPU caches, the device reads directly from RAM. If the zero-initialization has not yet been flushed from CPU caches to RAM, the IOMMU consumes whatever random data previously occupied that memory region. The result is unpredictable PASID entry interpretation by the device.
Root Cause
The root cause is an incorrect operation ordering in the PASID directory update path. The CPU cache flush, which synchronizes zero-initialized table contents to RAM, must happen before the directory entry referencing that table becomes visible to the IOMMU. The original implementation reversed this ordering, treating cache coherency as if the IOMMU and CPU shared cache visibility. This represents an uninitialized memory exposure to hardware (related to [CWE-908] Use of Uninitialized Resource) within a kernel driver.
Attack Vector
The issue is a hardware-software race rather than a directly attacker-driven vector. Triggering depends on the timing between PASID table allocation, directory entry publication, and IOMMU access on non-coherent platforms. A local workload that intensively exercises PASID allocation paths on affected hardware could increase the probability of the IOMMU sampling uninitialized data. The fix enforces the correct ordering so that the IOMMU never observes the directory entry until its target table is fully visible in RAM.
No public exploit is available, and the EPSS score is very low. See the upstream commits for the precise code change.
Detection Methods for CVE-2026-45862
Indicators of Compromise
- Sporadic DMA translation faults or unexpected IOMMU fault events logged by dmesg referencing PASID or VT-d errors
- Device misbehavior on systems with non-coherent IOMMU hardware shortly after device attach or PASID assignment
- Kernel log entries from the intel-iommu subsystem indicating PASID table inconsistencies
Detection Strategies
- Inventory Linux hosts and identify kernel versions running the intel-iommu driver with PASID-capable workloads such as SVA, SR-IOV, or accelerators
- Compare running kernel build identifiers against the fixed commits referenced in the upstream advisory
- Correlate IOMMU fault telemetry with PASID-related code paths to surface anomalous patterns
Monitoring Recommendations
- Forward kernel logs (/var/log/kern.log, journalctl -k) to a centralized log platform and alert on DMAR, iommu, and PASID-related fault strings
- Track kernel package versions across the fleet and flag hosts running unpatched releases
- Monitor systems using accelerators or devices that rely on PASID for shared virtual addressing, as these exercise the affected code path most frequently
How to Mitigate CVE-2026-45862
Immediate Actions Required
- Apply the upstream Linux kernel patch or update to a distribution kernel that includes the fix
- Prioritize patching hosts with non-coherent IOMMU hardware and PASID-dependent workloads
- Reboot affected systems after kernel updates to load the corrected intel-iommu driver
Patch Information
The fix has been merged into multiple stable Linux kernel branches. Reference commits include Kernel Git Commit 0616137, Kernel Git Commit 22d169b, Kernel Git Commit 36244df, Kernel Git Commit 3699040, Kernel Git Commit 5962c30, Kernel Git Commit c93f233, Kernel Git Commit cd75e77, and Kernel Git Commit d15cda1. The patch reorders the PASID table cache flush to occur before the PASID directory entry is updated.
Workarounds
- No supported software workaround exists; applying the kernel patch is the recommended remediation
- On systems where patching is not yet possible, avoid exposing PASID-dependent device assignment to untrusted workloads
- Consider disabling features that depend on PASID (such as shared virtual addressing) until the kernel is updated, where operationally feasible
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
