CVE-2026-45945: Linux Kernel Race Condition Vulnerability

CVE-2026-45945 Overview

CVE-2026-45945 is a race condition in the Linux kernel's Intel Virtualization Technology for Directed I/O (VT-d) driver. The flaw resides in the iommu/vt-d PASID (Process Address Space ID) entry replacement logic. The PASID table entry is 512 bits, but the hardware may fetch it in multiple 128-bit chunks. When the kernel replaces an active entry using a single structure assignment, the Input/Output Memory Management Unit (IOMMU) can observe a torn state containing partially new and partially old data. Maintainers resolved the issue by removing the unsafe replace helpers and enforcing a clear-then-update flow with proper invalidation.

Critical Impact
Torn reads of active PASID entries can produce inconsistent IOMMU state, leading to unpredictable Direct Memory Access (DMA) behavior or spurious faults on affected systems.

Affected Products

Linux kernel versions containing the Intel VT-d iommu/vt-d PASID replace helpers
Systems using Intel IOMMU with Shared Virtual Memory (SVM) or PASID-based domain replacement
Platforms relying on intel_pasid_get_entry for active PASID updates

Discovery Timeline

2026-05-27 - CVE-2026-45945 published to the National Vulnerability Database (NVD)
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45945

Vulnerability Analysis

The Intel VT-d PASID table entry occupies 64 bytes (512 bits). The kernel's previous implementation built a replacement entry on the stack and assigned it to the live table with a single C structure copy. The relevant pattern resembled obtaining a pointer through intel_pasid_get_entry, configuring a new entry with pasid_pte_config_first_level, and then performing *pte = new_pte.

This is unsafe because the IOMMU hardware does not guarantee atomic 512-bit reads. The hardware may load the entry as four 128-bit chunks. If the Present bit remains set during the update, the IOMMU can mix old and new fields within a single fetch.

The consequence is an inconsistent translation state for in-flight DMA. Devices using the affected PASID can trigger spurious faults, incorrect address translations, or unpredictable behavior. The fix removes the replace helpers and follows a clear-then-update sequence, which first clears the Present bit, completes the required Translation Lookaside Buffer (TLB) and device invalidation handshake, then writes the new configuration.

Root Cause

The defect is a race condition [CWE-362] caused by non-atomic update of a hardware-shared 64-byte structure. The structure assignment violates the hardware contract that the Present bit must be clear and invalidations must complete before the entry is rewritten.

Attack Vector

No public exploitation vector or proof-of-concept is associated with this CVE. The condition requires concurrent IOMMU activity against a PASID being replaced, such as domain replacement on an active device. The Exploit Prediction Scoring System (EPSS) probability is very low, consistent with a kernel correctness fix rather than a directly weaponizable flaw.

The vulnerability is described in prose because no verified exploit code exists. See the upstream commits Kernel Git Commit 66a7aff and Kernel Git Commit c3b1eda for the patch details.

Detection Methods for CVE-2026-45945

Indicators of Compromise

Unexpected DMA Remapping (DMAR) fault entries in dmesg referencing PASID translation failures on Intel VT-d systems
Sporadic device errors on endpoints that use Shared Virtual Memory or PASID-based domain replacement
Kernel log entries containing intel-iommu fault reasons that correlate with domain reattach or PASID teardown events

Detection Strategies

Inventory Linux hosts with Intel VT-d enabled and identify kernel versions predating the upstream fix commits
Monitor kernel build metadata to confirm whether the clear-then-update PASID flow is present
Correlate IOMMU fault telemetry with workloads performing frequent PASID domain replacement, such as accelerator or SR-IOV workloads

Monitoring Recommendations

Forward /var/log/kern.log and journald IOMMU fault events to a centralized logging pipeline for analysis
Alert on repeated DMAR: fault patterns following device reattach or virtualization operations
Track kernel package versions across the fleet to validate patch coverage on Intel platforms

How to Mitigate CVE-2026-45945

Immediate Actions Required

Apply distribution kernel updates that incorporate the upstream iommu/vt-d PASID clear-then-update commits
Identify hosts running affected kernels on Intel VT-d hardware and prioritize patching of systems using PASID or SVM workloads
Reboot updated systems to load the corrected kernel image

Patch Information

The fix is upstream in the Linux kernel through commits 66a7aff and c3b1eda. The patches remove the unsafe replace helpers in the Intel VT-d driver and enforce a clear-then-update flow. The Present bit is cleared first, the invalidation handshake completes, then the new PASID entry is written. Distribution maintainers backport these changes into supported stable kernel branches.

Workarounds

No official runtime workaround is published; the kernel patch is the supported remediation
Where patching is delayed, reduce workloads that trigger active PASID replacement, such as frequent IOMMU domain reattach on Intel hardware
Disable Intel VT-d or PASID-dependent features only when operationally acceptable and after validating the impact on virtualization and accelerator workloads

bash

# Verify running kernel and check for the fix in the changelog
uname -r
rpm -q --changelog kernel | grep -i "iommu/vt-d\|PASID"   # RHEL/CentOS
apt changelog linux-image-$(uname -r) | grep -i "iommu/vt-d\|PASID"  # Debian/Ubuntu

# Inspect IOMMU fault activity
dmesg | grep -iE "DMAR|intel-iommu|PASID"