CVE-2026-45894: Linux Kernel Race Condition Vulnerability

CVE-2026-45894 Overview

CVE-2026-45894 is a Linux kernel vulnerability in the Intel VT-d (Virtualization Technology for Directed I/O) IOMMU driver. The flaw resides in the Scalable Mode PASID (Process Address Space ID) table entry teardown logic. The current implementation zeroes the entire 64-byte PASID entry while it remains active with the Present bit set. This creates a race condition where IOMMU hardware can observe a torn, inconsistent state during concurrent fetches, producing unpredictable behavior or spurious faults. The issue affects kernel I/O memory management on Intel platforms supporting VT-d Scalable Mode.

Critical Impact
A race between CPU teardown and IOMMU hardware fetches can cause spurious DMA faults and unpredictable device behavior on systems using Intel VT-d Scalable Mode.

Affected Products

Linux kernel iommu/vt-d subsystem (Intel VT-d Scalable Mode)
Systems using Intel IOMMU with PASID-enabled devices
Stable kernel branches referenced in upstream commits 75ed000, 821807c, 949d716, and a84d30e

Discovery Timeline

2026-05-27 - CVE-2026-45894 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45894

Vulnerability Analysis

The Intel VT-d Scalable Mode PASID table entry is a 512-bit (64-byte) structure that the IOMMU hardware reads to translate DMA addresses for a given process. When tearing down an entry, the prior implementation issued multiple 64-bit writes to zero the full structure immediately, without first clearing the Present (P) bit and flushing caches.

The IOMMU may fetch the 64-byte entry using multiple internal transactions, for example four 128-bit bursts. If a hardware fetch executes concurrently with the CPU writes, the IOMMU can observe a partially-updated entry. This torn read produces inconsistent translation state, which can result in spurious DMA faults, misrouted transactions, or other unpredictable device behavior.

Root Cause

The root cause is a missing ownership handshake between software and hardware during PASID entry invalidation. The VT-d specification Section 6.5.3.3 ("Guidance to Software for Invalidations") requires clearing the Present bit first, issuing a write barrier, and executing the full invalidation sequence (PASID cache, IOTLB, Device-TLB flush) before modifying the remaining fields. The prior code skipped this protocol and modified the entry while the hardware still considered it active.

Attack Vector

This is a kernel correctness defect in the IOMMU teardown path rather than a directly attacker-controlled primitive. The race is triggered by normal PASID lifecycle events such as process exit or device detach while a PASID-enabled device performs DMA. There is no published proof-of-concept, no known exploitation, and no CISA KEV listing. The impact manifests as data corruption risk, spurious faults, or device hangs on affected Intel VT-d platforms.

The fix implements the specification-mandated sequence: clear only the Present bit, issue a dma_wmb() to publish the write to hardware, run the PASID cache, IOTLB, and Device-TLB invalidation flushes, and only then zero the remaining fields. A dma_wmb() is also added in pasid_set_present() so all other fields are visible to hardware before the Present bit is set during entry setup.

Detection Methods for CVE-2026-45894

Indicators of Compromise

Unexpected DMA remapping faults logged by DMAR: kernel messages on Intel VT-d systems
Sporadic device errors or hangs on PASID-enabled accelerators, GPUs, or SR-IOV devices
Kernel warnings referencing intel_pasid_tear_down_entry or PASID cache invalidation paths

Detection Strategies

Inventory hosts running Linux kernels lacking the upstream commits 75ed00055c05, 821807c167b7, 949d71666e9d, or a84d30e8d2ba
Correlate IOMMU fault telemetry with PASID teardown events such as process exit or device hot-unplug
Use distribution security trackers to identify kernel package versions still missing the backport

Monitoring Recommendations

Forward dmesg and journald IOMMU and DMAR events to a centralized log platform for anomaly review
Alert on repeated PASID-related fault sequences on hosts running PASID-capable workloads such as SVA, SVM, or vfio-pci with PASID
Track kernel version drift across the fleet to confirm patched builds are deployed

How to Mitigate CVE-2026-45894

Immediate Actions Required

Upgrade the Linux kernel to a stable release containing the upstream fix commits listed in the references
Prioritize patching on hosts using Intel VT-d Scalable Mode with PASID-enabled devices and SVA workloads
Validate that vendor kernels from RHEL, SUSE, Ubuntu, and Debian have backported the change before deployment

Patch Information

The vulnerability is resolved by the upstream Linux kernel commits Kernel Git Commit 75ed000, Kernel Git Commit 821807c, Kernel Git Commit 949d716, and Kernel Git Commit a84d30e. The patch reorders the PASID teardown to clear the Present bit first, perform required invalidations, and only then zero the remaining entry fields.

Workarounds

Where patching is not immediately possible, avoid workloads that rely on Intel VT-d Scalable Mode PASID features such as Shared Virtual Addressing
Disable Scalable Mode by booting with intel_iommu=on,sm_off on affected systems if PASID functionality is not required
Reduce churn in PASID lifecycle by limiting frequent attach and detach of PASID-enabled devices until the kernel is updated

bash

# Example: verify running kernel and check for PASID teardown fix presence
uname -r
dmesg | grep -iE 'DMAR|intel-iommu|pasid'
# Optional: disable VT-d Scalable Mode at boot if PASID is not needed
# Add to kernel cmdline: intel_iommu=on,sm_off