CVE-2026-89448: Linux Kernel VT-d Privilege Escalation Vulnerability

CVE-2026-89448 Overview

CVE-2026-89448 is a Linux kernel vulnerability in the Intel Virtualization Technology for Directed I/O (VT-d) IOMMU subsystem. The flaw exists in the detect_intel_iommu() function, which fails to consider Trusted Boot (tboot) when evaluating whether to request Access Control Services (ACS). When a user disables ACS through boot options while tboot later forces the IOMMU on via tboot_force_iommu(), the system runs with a misconfigured ACS state. This weakens PCIe device isolation guarantees that IOMMU-based protections rely on.

Critical Impact
Local attackers with access to a misconfigured system can leverage weakened PCIe isolation to compromise confidentiality, integrity, and availability across security boundaries.

Affected Products

Linux kernel Intel VT-d IOMMU driver (drivers/iommu/intel/)
Systems using Intel VT-d IOMMU with Trusted Boot (tboot) enabled
Linux distributions shipping affected upstream kernel versions

Discovery Timeline

2026-09-11 - CVE-2026-89448 published to the National Vulnerability Database
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89448

Vulnerability Analysis

The vulnerability resides in the Intel VT-d IOMMU initialization path in the Linux kernel. The detect_intel_iommu() function decides whether to request Access Control Services (ACS) for PCIe devices based on a set of conditions. Those conditions did not account for tboot state.

When a user disables IOMMU or ACS through kernel command-line options, detect_intel_iommu() honors that choice. However, tboot_force_iommu() can subsequently force the IOMMU on. This creates an inconsistent state where the IOMMU is active but ACS was never requested, breaking PCIe isolation assumptions in a Trusted Boot environment.

The attack surface is local because exploitation requires the target system to boot with tboot enabled and specific kernel parameter combinations that expose the misconfiguration. The impact spans confidentiality, integrity, and availability, and the scope changes because breaking device isolation affects resources beyond the initially vulnerable component.

Root Cause

The root cause is an incomplete conditional check in detect_intel_iommu(). The ACS request logic did not include tboot as a triggering condition. The fix adds a tboot check so that ACS is requested whenever tboot is enabled, aligning the boot-time IOMMU state with tboot's forced IOMMU behavior [CWE-1188: Insecure Default Initialization of Resource].

Attack Vector

Exploitation requires local access to a system that combines tboot with kernel options that would otherwise suppress ACS. A local attacker or malicious peripheral device could then exploit the absence of PCIe access control to reach memory or devices that should be isolated by the IOMMU. Because the scope is changed, a successful exploit can pivot beyond the originally trusted boundary established by tboot.

No public exploit is currently available. The vulnerability was resolved directly in the upstream kernel. See the kernel patch aaeb81241e80 and related backports for the exact code change.

Detection Methods for CVE-2026-89448

Indicators of Compromise

Kernel logs showing Intel-IOMMU initialization together with tboot: force iommu messages while ACS-related warnings are absent.
Unexpected DMA activity or PCIe transactions originating from devices that should be isolated by the IOMMU.
Systems booting with intel_iommu=off or ACS-disabling parameters while tboot is active.

Detection Strategies

Audit running kernels against the fixed commits referenced in the upstream advisory to identify unpatched hosts.
Inspect boot configurations for combinations of tboot with ACS or IOMMU suppression options.
Correlate dmesg output at boot with hardware inventory to detect systems where IOMMU is forced on without ACS.

Monitoring Recommendations

Monitor kernel version drift across the fleet and flag hosts running kernels older than the patched revisions listed in the stable tree references.
Alert on changes to boot parameters (/proc/cmdline) that introduce IOMMU or ACS overrides on tboot-enabled hosts.
Track PCIe device enumeration for anomalies indicating loss of isolation between endpoints.

How to Mitigate CVE-2026-89448

Immediate Actions Required

Update the Linux kernel to a version that includes the fix from the upstream commits referenced in the advisory.
Inventory tboot-enabled systems and prioritize patching them first, since the misconfiguration is only reachable in that configuration.
Review kernel command-line arguments and remove options that disable IOMMU or ACS on Trusted Boot hosts until patches are applied.

Patch Information

The fix modifies detect_intel_iommu() to check tboot state and force ACS requests when tboot is enabled. Backports are available across multiple stable branches:

Apply the vendor-provided kernel package once your distribution ships an update that incorporates these commits.

Workarounds

Disable tboot on affected hosts until a patched kernel is deployed, if the security model permits.
Avoid combining tboot with kernel parameters that suppress IOMMU or ACS behavior.
Restrict physical and local administrative access to systems that cannot be updated immediately.

bash

# Verify current kernel version and inspect boot options for risky combinations
uname -r
cat /proc/cmdline | tr ' ' '\n' | grep -Ei 'iommu|tboot|acs'