CVE-2026-64591 in Linux
Summary
by MITRE • 08/06/2026
In the Linux kernel, the following vulnerability has been resolved:
iommu/vt-d: Avoid WARNING in sva unbind path
The Intel IOMMU driver allows SVA on devices even if they do not support PCI/PRI. Commit 39c20c4e83b9 ("iommu/vt-d: Only handle IOPF for SVA when PRI is supported") modified the SVA bind path to allow this configuration by skipping IOPF enablement when PRI is missing. However, it failed to update the unbind path.
This creates an imbalance: the unbind path attempts to disable IOPF for a device that never had it enabled, triggering a WARNING in intel_iommu_disable_iopf():
WARNING: drivers/iommu/intel/iommu.c:3475 at intel_iommu_disable_iopf+0x4f/0x90d Call Trace: <TASK> blocking_domain_set_dev_pasid+0x50/0x70 iommu_detach_device_pasid+0x89/0xc0 iommu_sva_unbind_device+0x73/0x150 xe_vm_close_and_put+0x4d2/0x1200 [xe]
Fix this by bypassing IOPF operations for SVA domains on non-PRI hardware in both the bind and unbind paths.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/06/2026
The vulnerability exists within the Linux kernel's Intel IOMMU driver implementation, specifically affecting the virtualization and memory management subsystems that handle device pasid binding operations. This issue stems from an inconsistent implementation pattern in the SVA (Shared Virtual Addressing) functionality where the bind path was modified to support devices without PCI/PRI (Page Request Interface) capabilities, but the corresponding unbind path was not updated accordingly. The modification introduced in commit 39c20c4e83b9 attempted to address a previous limitation by allowing SVA operations on hardware that lacked PRI support, effectively bypassing IOPF (Input-Output Page Fault) enablement during the bind process. However, this change created an asymmetric state where the system could successfully bind devices without PRI support but failed during the unbind operation due to attempting to disable IOPF on devices where it was never enabled in the first place.
The technical flaw manifests as a warning condition within the intel_iommu_disable_iopf() function at line 3475 of drivers/iommu/intel/iommu.c, which occurs when the system attempts to disable IOPF for a device that was never properly initialized with IOPF support during the bind operation. This creates an operational inconsistency in the memory management layer where the kernel's IOMMU subsystem maintains different states for the same device across bind and unbind operations, leading to potential instability and error reporting within the system logs. The call trace demonstrates a cascading sequence of function calls starting from xe_vm_close_and_put which eventually leads to iommu_sva_unbind_device and then to the problematic intel_iommu_disable_iopf function, indicating that this issue impacts graphics drivers and virtual memory management components that rely on SVA operations.
The operational impact of this vulnerability extends beyond simple warning messages to potentially affect system stability and resource management in virtualized environments where IOMMU operations are critical for maintaining memory isolation between different processes and virtual machines. When the system encounters this condition, it generates kernel warnings that may indicate deeper issues with memory management consistency, particularly affecting graphics processing units and other hardware components that utilize SVA for efficient memory sharing. The inconsistency between bind and unbind paths could lead to resource leak conditions or improper device state management, especially in scenarios where multiple SVA operations occur rapidly or when the system experiences heavy virtualization workloads.
This vulnerability aligns with CWE-691, which describes insufficient control flow management in security-critical code paths, and can be categorized under ATT&CK technique T1547.009 related to kernel rootkits and privilege escalation through kernel manipulation. The fix implemented addresses this by ensuring consistent handling of IOPF operations across both bind and unbind paths for SVA domains, specifically bypassing IOPF operations when dealing with non-PRI hardware in both directions. This approach maintains the intended functionality of allowing SVA on devices without PRI support while preventing the inconsistent state that led to the warning condition, thereby aligning with security best practices for maintaining kernel stability and preventing unintended side effects in virtualized environments where IOMMU operations are essential for system integrity and memory protection mechanisms.