CVE-2026-74439
Received Received - Intake

IOMMU VT-d Context Entry Clearance Flaw

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry device_pasid_table_teardown() zeroes the 128-bit scalable-mode context entry with context_clear_entry() while the Present bit is still set. This creates a window where the hardware can fetch a torn entry, with some fields already zeroed while Present is still set, leading to unpredictable behavior or spurious faults. The context-cache invalidation is issued only after the entry has been zeroed, and intel_pasid_free_table() then frees the PASID directory pages, so the IOMMU can keep walking a stale Present=1 entry that points at freed memory. While x86 provides strong write ordering, the compiler may reorder the two 64-bit writes to the entry, and the hardware fetch is not guaranteed to be atomic with respect to multiple CPU writes. Commit c1e4f1dccbe9d ("iommu/vt-d: Clear Present bit before tearing down context entry") fixed this exact pattern in domain_context_clear_one() and the copied-context path, but device_pasid_table_teardown() was not converted. Align it with the "Guidance to Software for Invalidations" in the VT-d spec, Section 6.5.3.3, using the same ownership handshake as the sibling fix: clear only the Present bit, flush it to the IOMMU, perform the context-cache invalidation, and only then zero the rest of the entry.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-74439
EUVD
EUVD-2026-59586

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability where the Present bit in a scalable-mode context entry is cleared after zeroing the entry during teardown. This creates a window where hardware may fetch a partially zeroed entry with Present still set, leading to unpredictable behavior or faults. The fix ensures the Present bit is cleared first, followed by proper invalidation before zeroing the rest of the entry.

Detection Guidance

This vulnerability is specific to the Linux kernel's IOMMU implementation and requires kernel-level inspection. Detection involves checking kernel logs for IOMMU-related errors or examining the kernel version for the vulnerable code pattern. Commands like dmesg | grep -i iommu or checking kernel version with uname -r may help identify affected systems.

Impact Analysis

This vulnerability could cause system instability, crashes, or unexpected hardware faults due to the IOMMU fetching invalid or partially cleared context entries. It may lead to data corruption or denial of service if exploited.

Mitigation Strategies

Apply the kernel patch referenced in the CVE description (commit c1e4f1dccbe9d). Update to a Linux kernel version that includes this fix. If immediate patching is not possible, disable IOMMU scalable-mode as a temporary workaround by adding intel_iommu=off to kernel boot parameters.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74439. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart