Description
In the Linux kernel, the following vulnerability has been resolved:

iommu/vt-d: Avoid WARNING in sva unbind path

The Intel IOMMU driver allows SVA on devices even if they do not support
PCI/PRI. Commit 39c20c4e83b9 ("iommu/vt-d: Only handle IOPF for SVA when
PRI is supported") modified the SVA bind path to allow this configuration
by skipping IOPF enablement when PRI is missing. However, it failed to
update the unbind path.

This creates an imbalance: the unbind path attempts to disable IOPF for
a device that never had it enabled, triggering a WARNING in
intel_iommu_disable_iopf():

WARNING: drivers/iommu/intel/iommu.c:3475 at intel_iommu_disable_iopf+0x4f/0x90d
Call Trace:
<TASK>
blocking_domain_set_dev_pasid+0x50/0x70
iommu_detach_device_pasid+0x89/0xc0
iommu_sva_unbind_device+0x73/0x150
xe_vm_close_and_put+0x4d2/0x1200 [xe]

Fix this by bypassing IOPF operations for SVA domains on non-PRI hardware
in both the bind and unbind paths.
Published: 2026-08-06
Score: n/a
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A bug in the Linux kernel Intel IOMMU driver causes a warning to be emitted when an SVA (Support for Virtual Addressing) device is unbound on hardware that does not support PCI/PRI. The driver previously did not enable IOPF for such devices when binding, but the unbind path still attempted to disable IOPF, which had never been enabled. This mismatched operation triggers a warning in intel_iommu_disable_iopf() but does not alter device functionality or security state. The issue manifests only as a kernel log message and does not offer an attacker a means to execute code, gain elevated privileges, or breach confidentiality or integrity.

Affected Systems

All Linux kernel builds that contain the Intel IOMMU driver before the fast fix commit (39c20c4e83b9) are affected. The vulnerability applies to any distribution or custom kernel that has not been updated to a version including this patch. No specific version numbers are provided in the data, so any kernel prior to the commit should be considered vulnerable.

Risk and Exploitability

The CVSS score is not available and the exploit probability score (EPSS) is not disclosed, indicating uncertainty about how frequently this will be triggered. The vulnerability is not listed in the CISA KEV catalog, and there is no known active exploitation. Because the bug only produces a warning without enabling any additional privileges, the overall risk is low. The most likely attack vector would involve a local user, but only to observe warnings in the system logs, which does not constitute a security incident.

Generated by OpenCVE AI on August 6, 2026 at 09:28 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the kernel to a version that includes commit 39c20c4e83b9 or newer, which corrects both the bind and unbind handling for SVA domains on non‑PCI/PRI.
  • If an immediate kernel update is not feasible, suppress or monitor the warning output in the kernel logs and avoid enabling SVA on devices that lack PCI/PRI support until a patched kernel is available.
  • Consider disabling IOPF for SVA on non‑PCI/PRI devices at system startup via configuration, if such an option is available, as a temporary mitigation until the kernel can be upgraded.

Generated by OpenCVE AI on August 6, 2026 at 09:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 06 Aug 2026 09:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-703

Thu, 06 Aug 2026 07:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Avoid WARNING in sva unbind path The Intel IOMMU driver allows SVA on devices even if they do not support PCI/PRI. Commit 39c20c4e83b9 ("iommu/vt-d: Only handle IOPF for SVA when PRI is supported") modified the SVA bind path to allow this configuration by skipping IOPF enablement when PRI is missing. However, it failed to update the unbind path. This creates an imbalance: the unbind path attempts to disable IOPF for a device that never had it enabled, triggering a WARNING in intel_iommu_disable_iopf(): WARNING: drivers/iommu/intel/iommu.c:3475 at intel_iommu_disable_iopf+0x4f/0x90d Call Trace: <TASK> blocking_domain_set_dev_pasid+0x50/0x70 iommu_detach_device_pasid+0x89/0xc0 iommu_sva_unbind_device+0x73/0x150 xe_vm_close_and_put+0x4d2/0x1200 [xe] Fix this by bypassing IOPF operations for SVA domains on non-PRI hardware in both the bind and unbind paths.
Title iommu/vt-d: Avoid WARNING in sva unbind path
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-06T07:13:48.490Z

Reserved: 2026-07-19T15:36:31.798Z

Link: CVE-2026-64591

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-06T11:45:03Z

Weaknesses
  • CWE-703

    Improper Check or Handling of Exceptional Conditions