CVE-2026-90240 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
iommu/vt-d: Flush context cache with correct SID when tearing down aliases
domain_context_clear_one() and device_pasid_table_teardown() are both invoked once per DMA alias of a device. Each function locates the context entry using the bus/devfn pair provided by the pci_for_each_dma_alias() callback, then calls intel_context_flush_no_pasid(), which constructs a device-selective context-cache invalidation from info->bus and info->devfn (that is, always the requester ID of the device itself).
As a result, for every alias other than the device’s own RID, the context entry that was just cleared in memory is never invalidated in the context cache. Hardware may continue using that stale cached entry. In the scalable-mode teardown path, intel_pasid_free_table() can then free the PASID directory still referenced by that stale entry, allowing the IOMMU to walk freed memory.
Fix this by passing the source ID of the entry being torn down to intel_context_flush_no_pasid(), instead of deriving it from @info.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability in question resides within the Intel IOMMU driver subsystem of the Linux kernel, specifically affecting the handling of DMA alias teardown operations. The core issue stems from a mismatch between the logical device identifier used to clear context entries and the physical source ID required for hardware cache invalidation. When managing devices with multiple PCI function numbers or aliases, such as those found in SR-IOV configurations or complex bus topologies, the kernel iterates through each alias using pci_for_each_dma_alias(). For every iteration, functions like domain_context_clear_one() and device_pasid_table_teardown() are invoked to clean up resources. These functions correctly locate and clear the corresponding context entry in system memory based on the provided bus and device/function number pair. However, they subsequently call intel_context_flush_no_pasid(), which constructs a hardware command for context-cache invalidation using only the requester ID of the primary device rather than the specific alias being processed.
This discrepancy creates a critical state inconsistency between software-managed data structures and IOMMU hardware caches. While the kernel successfully removes the mapping from its internal tables, the Intel IOMMU hardware retains a stale copy of that context entry in its on-chip cache because the invalidation command targeted only the primary device's source ID. Consequently, for any alias other than the original requester ID, the hardware continues to utilize the now-invalidated memory mappings. This situation is particularly dangerous during teardown sequences where resources are being released. In scalable mode operations, the function intel_pasid_free_table() may proceed to free the PASID directory structures that were still referenced by these stale cached entries in the IOMMU.
The operational impact of this flaw is severe and directly leads to memory corruption vulnerabilities. Because the hardware continues to walk through freed memory using the stale context entry, it can result in out-of-bounds reads or writes depending on what data occupies the reclaimed memory space at that moment. This effectively allows an attacker who controls the device or has compromised a guest VM with passthrough capabilities to trigger arbitrary code execution or cause a system crash by manipulating the IOMMU's access patterns against freed kernel memory structures. The vulnerability represents a classic race condition and logic error where software state is not properly synchronized with hardware state, leading to use-after-free scenarios that bypass standard protection mechanisms.
From a classification perspective, this flaw aligns closely with CWE-416, Use After Free, as the IOMMU accesses memory regions that have been deallocated by the kernel due to stale caching preventing proper invalidation. It also relates to CWE-362, Concurrent Execution using Shared Resource with Improper Synchronization, in the sense that the hardware cache and software tables are not kept consistent during concurrent teardown operations across multiple aliases. In terms of MITRE ATT&CK mapping, this vulnerability facilitates techniques associated with T1055, Process Injection, or more broadly T1068, Exploitation for Privilege Escalation, by allowing an unprivileged user to gain kernel-level access through IOMMU manipulation. The lack of proper cache coherency during resource deallocation is a common pitfall in low-level system programming that requires rigorous validation of hardware-specific identifiers.
To mitigate this vulnerability, the fix involves modifying intel_context_flush_no_pasid() to accept and utilize the source ID of the specific entry being torn down rather than deriving it from generic device information. This ensures that every alias's context cache is explicitly invalidated in the IOMMU before any associated memory structures are freed. System administrators should ensure their kernels are updated with patches addressing this Intel IOMMU driver flaw, particularly if they utilize virtualization environments with PCI passthrough or SR-IOV enabled devices. Regular kernel updates and enabling hardware-assisted I/O protection features where available can further reduce the attack surface by limiting the potential impact of such cache inconsistencies on system stability and security posture.