Linux Kernel up to 6.19.3 iommu pasid_entry race condition

Summaryinfo

A vulnerability was found in Linux Kernel up to 6.19.3. It has been rated as critical. The impacted element is the function pasid_entry of the component iommu. Performing a manipulation results in race condition. This vulnerability is cataloged as CVE-2026-45945. There is no exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as critical has been found in Linux Kernel up to 6.19.3. This affects the function pasid_entry of the component iommu. The manipulation with an unknown input leads to a race condition vulnerability. CWE is classifying the issue as CWE-362. The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently. The impact remains unknown. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix race condition during PASID entry replacement The Intel VT-d PASID table entry is 512 bits (64 bytes). When replacing an active PASID entry (e.g., during domain replacement), the current implementation calculates a new entry on the stack and copies it to the table using a single structure assignment. struct pasid_entry *pte, new_pte; pte = intel_pasid_get_entry(dev, pasid); pasid_pte_config_first_level(iommu, &new_pte, ...); *pte = new_pte; Because the hardware may fetch the 512-bit PASID entry in multiple 128-bit chunks, updating the entire entry while it is active (Present bit set) risks a "torn" read. In this scenario, the IOMMU hardware could observe an inconsistent state — partially new data and partially old data — leading to unpredictable behavior or spurious faults. Fix this by removing the unsafe "replace" helpers and following the "clear-then-update" flow, which ensures the Present bit is cleared and the required invalidation handshake is completed before the new configuration is applied.

It is possible to read the advisory at git.kernel.org. This vulnerability is uniquely identified as CVE-2026-45945 since 05/13/2026. The exploitability is told to be difficult. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 6.19.4 eliminates this vulnerability. Applying the patch 66a7aff480a82b8642b3991fed5fdc9780022157/c3b1edea3791fa91ab7032faa90355913ad9451b is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.19.0
• 6.19.1
• 6.19.2
• 6.19.3

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion