Description
In the Linux kernel, the following vulnerability has been resolved:

iommu/vt-d: Clear Present bit before tearing down context entry

When tearing down a context entry, the current implementation zeros the
entire 128-bit entry using multiple 64-bit writes. This creates a window
where the hardware can fetch a "torn" entry — where some fields are
already zeroed while the 'Present' bit is still set — leading to
unpredictable behavior or spurious faults.

While x86 provides strong write ordering, the compiler may reorder writes
to the two 64-bit halves of the context entry. Even without compiler
reordering, the hardware fetch is not guaranteed to be atomic with
respect to multiple CPU writes.

Align with the "Guidance to Software for Invalidations" in the VT-d spec
(Section 6.5.3.3) by implementing the recommended ownership handshake:

1. Clear only the 'Present' (P) bit of the context entry first to
signal the transition of ownership from hardware to software.
2. Use dma_wmb() to ensure the cleared bit is visible to the IOMMU.
3. Perform the required cache and context-cache invalidation to ensure
hardware no longer has cached references to the entry.
4. Fully zero out the entry only after the invalidation is complete.

Also, add a dma_wmb() to context_set_present() to ensure the entry
is fully initialized before the 'Present' bit becomes visible.
Published: 2026-05-27
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

In the Linux kernel, the vt‑d implementation clears a 128‑bit IOMMU context entry by writing two 64‑bit halves without first clearing the Present bit. When the hardware fetches a partially cleared entry, it sees a "torn" structure—where some fields are already zeroed while the 'Present' bit is still set—leading to unpredictable behavior or spurious faults. This race condition and improper memory ordering (CWE‑367) can cause hardware to miss synchronisation between software and DMA activity.

Affected Systems

All Linux kernel builds that include the pre‑patch teardown logic are affected; the patch is applied to kernels after the commit that adds dma_wmb() ordering and clears the Present bit first. Users running x86 kernels with IOMMU enabled should check whether their kernel version predates this change.

Risk and Exploitability

The CVSS score is 7.5, a high severity. The EPSS score is below 1 %, indicating an extremely low likelihood of exploitation. The vulnerability is not listed in CISA KEV, so no known active exploitation is reported. Based on the description, it is inferred that an exploit would require control of a DMA device or other IOMMU‑capable hardware, and would be a local attack that could affect normal operation of the IOMMU subsystem.

Generated by OpenCVE AI on June 16, 2026 at 21:22 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the kernel to a version that implements the vt‑d ownership handshake and dma_wmb() ordering changes to clear the Present bit first
  • If a kernel upgrade is not immediately possible, consider disabling or restricting DMA access for devices that use the affected IOMMU context until a patch is applied
  • If newer kernel versions are unavailable, download and apply the upstream patch that clears the Present bit before tearing down context entries and rebuild the kernel

Generated by OpenCVE AI on June 16, 2026 at 21:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 16 Jun 2026 06:30:00 +0000

Type Values Removed Values Added
Weaknesses NVD-CWE-noinfo

Sat, 30 May 2026 11:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H'}


Thu, 28 May 2026 16:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-362
CWE-364

Thu, 28 May 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-367
References
Metrics threat_severity

None

cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate


Wed, 27 May 2026 17:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-362
CWE-364

Wed, 27 May 2026 14:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clear Present bit before tearing down context entry When tearing down a context entry, the current implementation zeros the entire 128-bit entry using multiple 64-bit writes. This creates a window where the hardware can fetch a "torn" entry — where some fields are already zeroed while the 'Present' bit is still set — leading to unpredictable behavior or spurious faults. While x86 provides strong write ordering, the compiler may reorder writes to the two 64-bit halves of the context entry. Even without compiler reordering, the hardware fetch is not guaranteed to be atomic with respect to multiple CPU writes. Align with the "Guidance to Software for Invalidations" in the VT-d spec (Section 6.5.3.3) by implementing the recommended ownership handshake: 1. Clear only the 'Present' (P) bit of the context entry first to signal the transition of ownership from hardware to software. 2. Use dma_wmb() to ensure the cleared bit is visible to the IOMMU. 3. Perform the required cache and context-cache invalidation to ensure hardware no longer has cached references to the entry. 4. Fully zero out the entry only after the invalidation is complete. Also, add a dma_wmb() to context_set_present() to ensure the entry is fully initialized before the 'Present' bit becomes visible.
Title iommu/vt-d: Clear Present bit before tearing down context entry
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-05-30T10:46:08.651Z

Reserved: 2026-05-13T15:03:33.087Z

Link: CVE-2026-45944

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2026-05-27T14:17:10.677

Modified: 2026-06-16T02:37:20.093

Link: CVE-2026-45944

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-05-27T00:00:00Z

Links: CVE-2026-45944 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-06-16T21:30:16Z

Weaknesses