CVE-2026-89448
Received Received - Intake

IOMMU ACS Forced Enablement with Tboot in Linux Kernel

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Force requesting ACS when tboot is enabled Currently the conditions of requesting ACS in detect_intel_iommu() don't include tboot, leading to a possible misconfiguration with ACS disabled (e.g. due to user opts) while iommu is later forced on by tboot_force_iommu(). Fix it by checking tboot in detect_intel_iommu().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-12
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-89448
EUVD
EUVD-2026-76354

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a missing check for tboot (Trusted Boot) when enabling Access Control Services (ACS) for Intel IOMMU. Normally ACS is requested under certain conditions, but tboot was not included, which could lead to ACS being disabled even when tboot forces IOMMU on later.

Detection Guidance

This vulnerability is specific to the Linux kernel's IOMMU subsystem when Intel TXT (Trusted Execution Technology) is enabled. Detection requires checking kernel boot parameters and IOMMU configuration. Review kernel logs for IOMMU errors or misconfigurations during boot. Check if 'intel_iommu=on' and 'tboot' are present in kernel command line parameters. Use 'dmesg | grep -i iommu' or 'cat /proc/cmdline' to inspect these settings.

Impact Analysis

This could allow a misconfiguration where security features like IOMMU are not properly enforced due to ACS being disabled, potentially exposing the system to unauthorized access or attacks if tboot is used.

Mitigation Strategies

Ensure ACS (Access Control Services) is enabled for Intel IOMMU by adding 'intel_iommu=on,sm_on' to kernel boot parameters. Verify tboot is properly configured to force IOMMU. Update to a patched kernel version that includes the fix. Monitor kernel logs for IOMMU-related errors after applying changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89448. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart