CVE-2026-64591: Linux Kernel Privilege Escalation Flaw

CVE-2026-64591 Overview

CVE-2026-64591 affects the Linux kernel Intel IOMMU driver (iommu/vt-d) in the Shared Virtual Addressing (SVA) unbind code path. The Intel IOMMU driver permits SVA on devices that do not support PCI Page Request Interface (PRI). A prior commit updated the bind path to skip I/O Page Fault (IOPF) enablement when PRI is missing but did not apply the same handling to the unbind path. This asymmetry causes the unbind path to attempt IOPF disable on a device where IOPF was never enabled, triggering a kernel WARNING in intel_iommu_disable_iopf().

Critical Impact
The imbalance produces kernel warnings during SVA teardown on non-PRI hardware, disrupting device teardown workflows such as those in the Xe DRM driver.

Affected Products

Linux kernel builds containing commit 39c20c4e83b9 prior to the fix
Intel VT-d IOMMU driver on non-PRI capable devices
Systems using SVA with the Xe graphics driver on affected kernels

Discovery Timeline

2026-08-06 - CVE-2026-64591 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-64591

Vulnerability Analysis

The defect resides in the Intel VT-d SVA lifecycle management. Commit 39c20c4e83b9 ("iommu/vt-d: Only handle IOPF for SVA when PRI is supported") modified the SVA bind path to bypass IOPF enablement when the device lacks PCI/PRI support. The corresponding unbind path was not updated, creating a state mismatch between bind and unbind operations.

During SVA teardown, the kernel invokes intel_iommu_disable_iopf() for a device that never had IOPF enabled. This condition triggers a WARNING at drivers/iommu/intel/iommu.c:3475. The call chain includes blocking_domain_set_dev_pasid, iommu_detach_device_pasid, iommu_sva_unbind_device, and xe_vm_close_and_put from the Xe graphics driver.

Root Cause

The root cause is an asymmetric state machine in the SVA bind and unbind paths. The bind path checks PRI capability before enabling IOPF, but the unbind path unconditionally attempts IOPF disable. The fix bypasses IOPF operations for SVA domains on non-PRI hardware in both paths, restoring symmetry.

Attack Vector

This is a kernel logic defect reachable through normal SVA teardown on non-PRI capable devices. Triggering the condition requires a workload that binds and unbinds SVA against a device without PCI/PRI, such as closing an Xe virtual memory context. The result is a kernel WARNING rather than a direct security bypass; see the referenced kernel commits for the exact code paths.

No verified public exploit code exists for this issue. The vulnerability manifests as a kernel warning in the SVA teardown path and is described in the upstream commit messages linked in the references.

Detection Methods for CVE-2026-64591

Indicators of Compromise

Kernel log entries containing WARNING: drivers/iommu/intel/iommu.c:3475 at intel_iommu_disable_iopf
Stack traces including iommu_sva_unbind_device and blocking_domain_set_dev_pasid
Warnings emitted during xe_vm_close_and_put on Intel graphics hardware without PRI

Detection Strategies

Monitor dmesg and journalctl -k for intel_iommu_disable_iopf warning signatures across affected fleets
Enumerate kernel versions against the fixed commit hashes 477f8dec3b5a, 534b5f98ab73, and bb354384f40b
Correlate SVA-using workloads (Xe, compute accelerators) with devices lacking PCI/PRI capability

Monitoring Recommendations

Collect kernel ring buffer events centrally and alert on WARNING entries referencing intel/iommu.c
Track IOMMU driver behavior on hosts running GPU compute or accelerator workloads
Baseline SVA bind and unbind rates to identify recurring teardown warnings

How to Mitigate CVE-2026-64591

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable tree commits
Update to a kernel release that includes commits 477f8dec3b5a, 534b5f98ab73, or bb354384f40b
Audit hosts using Intel VT-d SVA with non-PRI devices for exposure

Patch Information

The fix bypasses IOPF operations for SVA domains on non-PRI hardware in both the bind and unbind paths. Patches are available in the Linux stable tree via the kernel.org commit references. Distribution kernels should pick up the fix in their next stable rebase.

Workarounds

Avoid enabling SVA on Intel devices that do not advertise PCI/PRI capability until patched
Disable Xe SVA-dependent features on affected hosts where possible
Suppress non-security-relevant impact by pinning affected workloads to hardware with PRI support

bash

# Verify kernel version and IOMMU driver state
uname -r
dmesg | grep -Ei 'intel-iommu|intel_iommu_disable_iopf'
# Confirm patched commit is present in the running kernel source tree
git -C /usr/src/linux log --oneline | grep -E '477f8dec3b5a|534b5f98ab73|bb354384f40b'