CVE-2026-74439 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry
device_pasid_table_teardown() zeroes the 128-bit scalable-mode context entry with context_clear_entry() while the Present bit is still set. This creates a window where the hardware can fetch a torn entry, with some fields already zeroed while Present is still set, leading to unpredictable behavior or spurious faults. The context-cache invalidation is issued only after the entry has been zeroed, and intel_pasid_free_table() then frees the PASID directory pages, so the IOMMU can keep walking a stale Present=1 entry that points at freed memory.
While x86 provides strong write ordering, the compiler may reorder the two 64-bit writes to the entry, and the hardware fetch is not guaranteed to be atomic with respect to multiple CPU writes.
Commit c1e4f1dccbe9d ("iommu/vt-d: Clear Present bit before tearing down context entry") fixed this exact pattern in domain_context_clear_one() and the copied-context path, but device_pasid_table_teardown() was not converted.
Align it with the "Guidance to Software for Invalidations" in the VT-d spec, Section 6.5.3.3, using the same ownership handshake as the sibling fix: clear only the Present bit, flush it to the IOMMU, perform the context-cache invalidation, and only then zero the rest of the entry.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/15/2026
This vulnerability affects the Linux kernel's implementation of Intel Virtualization Technology for Directed I/O (VT-d) IOMMU subsystem, specifically within the scalable-mode context entry management. The issue occurs in the device_pasid_table_teardown() function where a race condition can lead to unpredictable system behavior due to improper sequence of memory operations during context entry teardown. The vulnerability stems from the fact that while the 128-bit scalable-mode context entry is being zeroed using context_clear_entry(), the Present bit remains set, creating a temporal window where hardware can fetch a partially zeroed entry with stale data.
The technical flaw manifests when device_pasid_table_teardown() performs operations in incorrect order, specifically zeroing the entire context entry before clearing the Present bit and issuing invalidation commands. This sequence allows for potential hardware memory access during the transition period where some fields contain zero values while the Present bit still indicates valid content. The problematic behavior is particularly concerning because it can cause the IOMMU to walk through a stale entry that points to freed memory pages, resulting in spurious faults or system instability. According to the VT-d specification's Guidance to Software for Invalidations in Section 6.5.3.3, proper sequence requires clearing only the Present bit first, flushing the change to IOMMU hardware, performing context-cache invalidation, and then proceeding with zeroing the remainder of the entry.
The operational impact of this vulnerability extends beyond simple system instability to potential security implications within virtualized environments. When the IOMMU continues to reference freed memory through stale Present=1 entries, it can lead to information disclosure or privilege escalation attacks that exploit the improper memory management during context teardown. The vulnerability is particularly dangerous in multi-tenant virtualization scenarios where malicious guests could potentially manipulate IOMMU behavior to access unauthorized memory regions. Additionally, this flaw affects systems with x86 processors that provide strong write ordering but may still allow compiler reordering of 64-bit write operations, creating additional attack surface through software-level memory reordering.
The fix implemented addresses this by aligning the device_pasid_table_teardown() function with existing patterns already applied to domain_context_clear_one() and copied-context paths. This remediation follows the established ownership handshake pattern that ensures proper ordering of operations: first clear only the Present bit, then flush it to IOMMU hardware to guarantee visibility before proceeding with cache invalidation, and finally zero the remaining entry fields. This approach directly addresses the root cause identified through CWE-116 weakness classification related to improper handling of memory synchronization and data races. The solution adheres to ATT&CK technique T1068 by preventing unauthorized privilege escalation through memory management flaws, while also addressing T1547 by ensuring proper system integrity during IOMMU context transitions. The mitigation strategy reduces the attack surface by eliminating the window where hardware can access torn entries and prevents potential exploitation of memory corruption vulnerabilities in IOMMU subsystems.
This vulnerability demonstrates the complexity of managing hardware-software interactions in virtualization environments, particularly where IOMMU implementations must maintain strict ordering requirements for memory operations. The fix ensures compliance with VT-d specification requirements and maintains system stability during context teardown operations while preventing potential security implications from improper memory state management.