CVE-2026-68329 - Vulnerability Details

- iommu/amd: Wait for completion instead of returning early in iommu_completion_wait()

Description

In the Linux kernel, the following vulnerability has been resolved:

iommu/amd: Wait for completion instead of returning early in iommu_completion_wait()

need_sync is a per-IOMMU flag shared by all domains and devices behind
that IOMMU. It is set whenever a command is queued with sync == true and
cleared when a completion-wait (CWAIT) command is queued. However, a
cleared need_sync only means that a covering CWAIT has been queued, not
that all previously queued commands have actually completed in hardware.

iommu_completion_wait() read need_sync locklessly and returned early
when it was false. This breaks the "block until all previously queued
commands have completed" contract in a multi-CPU scenario:

CPU2: queue inv-B => need_sync = true
CPU1: queue CWAIT(N); need_sync = false; then wait_on_sem(N)
CPU2: read need_sync == false => return 0 (no wait!)

CPU2 returns without waiting for any sequence number even though its
inv-B may not have completed yet (CWAIT(N), queued after inv-B, has not
been signaled). CPU2 then proceeds to, for example, free page-table
pages while the IOMMU can still walk stale translations, opening a
use-after-free window. This is a logical race in the meaning of the
flag, not a memory-visibility issue, so barriers alone do not help.

Fix it without losing the optimization of avoiding redundant CWAIT
commands: take iommu->lock before testing need_sync, and when it is
false do not return early but wait for the last allocated sequence
number (cmd_sem_val). Since need_sync == false implies no sync command
was queued after the last CWAIT, that CWAIT is FIFO-ordered after every
not-yet-completed command, so waiting for its sequence number guarantees
all prior commands (possibly queued by another CPU) have completed. The
common path with pending work is unchanged and no extra hardware command
is issued.

Published: 2026-08-10

Score: 8.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The flaw is a race condition in the AMD IOMMU driver that allows the shared need_sync flag to be cleared before all queued commands have completed. When a CPU checks the flag without proper locking, it can return early and free page‑table entries while the IOMMU may still reference them. This creates a use‑after‑free that can corrupt kernel memory. The vulnerability is a logical race (CWE-362) that violates the FIFO completion contract (CWE-367).

Affected Systems

The likely affected systems are all Linux kernels that include the AMD IOMMU implementation, including the default kernels in most distributions that support device assignment through IOMMU. Based on the advisory wording that no specific version ranges are listed, any kernel that contains the vulnerability code prior to the patch is potentially affected.

Risk and Exploitability

The CVSS score of 8.8 indicates high severity, while the EPSS score of <1% suggests exploitation is unlikely in the wild. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector requires local access on a multi‑CPU system and the attacker must trigger concurrent IOMMU commands to force the race; no publicly disclosed exploits exist at this time.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`815b33fdc279d34ab40a8bfe1866623a4cc5669b`	affected	< 82c9a749d44efaaa1a1c781f8a6cf1747718f228
`815b33fdc279d34ab40a8bfe1866623a4cc5669b`	affected	< ab7faf5a172ebfdc423ebb3eea4d472740de82f9
`815b33fdc279d34ab40a8bfe1866623a4cc5669b`	affected	< 93494bd446396c257fb589f59894577e96e406e2
`815b33fdc279d34ab40a8bfe1866623a4cc5669b`	affected	< d053eb7e09e10cbdca3fca8b35c1017d438091b2
`815b33fdc279d34ab40a8bfe1866623a4cc5669b`	affected	< 02f8cefa2ad95ea3754f0cfd6fbae7f866202ccb
`815b33fdc279d34ab40a8bfe1866623a4cc5669b`	affected	< 1e75a8255f11c81fb07e81e5029cfd75804350a0

Linux

affected

Version	Status	Constraints
`3.0`	affected	—
`0`	unaffected	< 3.0
`6.1.191`	unaffected	≤ 6.1.*
`6.6.148`	unaffected	≤ 6.6.*
`6.12.101`	unaffected	≤ 6.12.*
`6.18.42`	unaffected	≤ 6.18.*
`7.1.6`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[815b33fdc279d34ab40a8bfe1866623a4cc5669b,ab7faf5a172ebfdc423ebb3eea4d472740de82f9)`	affected	code_commit	—
`[815b33fdc279d34ab40a8bfe1866623a4cc5669b,93494bd446396c257fb589f59894577e96e406e2)`	affected	code_commit	—
`[815b33fdc279d34ab40a8bfe1866623a4cc5669b,d053eb7e09e10cbdca3fca8b35c1017d438091b2)`	affected	code_commit	—
`[815b33fdc279d34ab40a8bfe1866623a4cc5669b,02f8cefa2ad95ea3754f0cfd6fbae7f866202ccb)`	affected	code_commit	—
`[815b33fdc279d34ab40a8bfe1866623a4cc5669b,1e75a8255f11c81fb07e81e5029cfd75804350a0)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.0`	affected	generic	—
`[0,3.0)`	unaffected	generic	—
`[6.6.148,6.7.0)`	unaffected	semver	—
`[6.12.101,6.13.0)`	unaffected	semver	—
`[6.18.42,6.19.0)`	unaffected	semver	—
`[7.1.6,7.2.0)`	unaffected	semver	—
`[7.2-rc5,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest kernel update that incorporates the commit fixing the iommu/amd race condition.
If a distribution update is not yet available, rebuild the kernel from source using the patch identified in the advisory URLs.
Disable IOMMU support when it is not required, for example by setting CONFIG_IOMMU_SUPPORT to 'n' in the kernel configuration.

Generated by OpenCVE AI on October 20, 2026 at 13:33 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4745-1	linux-6.12 security update
Ubuntu USN	USN-8887-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8888-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8889-1	Linux kernel (OEM) vulnerabilities
Ubuntu USN	USN-8887-2	Linux kernel (AWS) vulnerabilities
Ubuntu USN	USN-8888-2	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8887-3	Linux kernel vulnerabilities
Ubuntu USN	USN-8917-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8918-1	Linux kernel (Azure) vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00126.

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://git.kernel.org/stable/c/02f8cefa2ad95ea3754f0cfd6fbae7f866202ccb
https://git.kernel.org/stable/c/1e75a8255f11c81fb07e81e5029cfd75804350a0
https://git.kernel.org/stable/c/82c9a749d44efaaa1a1c781f8a6cf1747718f228
https://git.kernel.org/stable/c/93494bd446396c257fb589f59894577e96e406e2
https://git.kernel.org/stable/c/ab7faf5a172ebfdc423ebb3eea4d472740de82f9
https://git.kernel.org/stable/c/d053eb7e09e10cbdca3fca8b35c1017d438091b2
https://nvd.nist.gov/vuln/detail/CVE-2026-68329
https://www.cve.org/CVERecord?id=CVE-2026-68329

History

Fri, 30 Oct 2026 12:45:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/82c9a749d44efaaa1a1c781f8a6cf1747718f228

Mon, 19 Oct 2026 22:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-362

Sat, 17 Oct 2026 13:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Thu, 13 Aug 2026 23:15:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H'}`	cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}`

Thu, 13 Aug 2026 05:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416 CWE-847

Wed, 12 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-367
References		https://nvd.nist.gov/vuln/detail/CVE-2026-68329 https://www.cve.org/CVERecord?id=CVE-2026-68329
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H'}` threat_severity `Moderate`

Mon, 10 Aug 2026 16:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416 CWE-847

Mon, 10 Aug 2026 12:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() need_sync is a per-IOMMU flag shared by all domains and devices behind that IOMMU. It is set whenever a command is queued with sync == true and cleared when a completion-wait (CWAIT) command is queued. However, a cleared need_sync only means that a covering CWAIT has been queued, not that all previously queued commands have actually completed in hardware. iommu_completion_wait() read need_sync locklessly and returned early when it was false. This breaks the "block until all previously queued commands have completed" contract in a multi-CPU scenario: CPU2: queue inv-B => need_sync = true CPU1: queue CWAIT(N); need_sync = false; then wait_on_sem(N) CPU2: read need_sync == false => return 0 (no wait!) CPU2 returns without waiting for any sequence number even though its inv-B may not have completed yet (CWAIT(N), queued after inv-B, has not been signaled). CPU2 then proceeds to, for example, free page-table pages while the IOMMU can still walk stale translations, opening a use-after-free window. This is a logical race in the meaning of the flag, not a memory-visibility issue, so barriers alone do not help. Fix it without losing the optimization of avoiding redundant CWAIT commands: take iommu->lock before testing need_sync, and when it is false do not return early but wait for the last allocated sequence number (cmd_sem_val). Since need_sync == false implies no sync command was queued after the last CWAIT, that CWAIT is FIFO-ordered after every not-yet-completed command, so waiting for its sequence number guarantees all prior commands (possibly queued by another CPU) have completed. The common path with pending work is unchanged and no extra hardware command is issued.
Title		iommu/amd: Wait for completion instead of returning early in iommu_completion_wait()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/02f8cefa2ad95ea3754f0cfd6fbae7f866202ccb https://git.kernel.org/stable/c/1e75a8255f11c81fb07e81e5029cfd75804350a0 https://git.kernel.org/stable/c/93494bd446396c257fb589f59894577e96e406e2 https://git.kernel.org/stable/c/ab7faf5a172ebfdc423ebb3eea4d472740de82f9 https://git.kernel.org/stable/c/d053eb7e09e10cbdca3fca8b35c1017d438091b2

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-10T12:03:05.526Z

Updated: 2026-10-30T12:28:24.585Z

Reserved: 2026-07-30T09:28:09.383Z

Link: CVE-2026-68329

Vulnrichment

Updated: 2026-10-16T15:47:12.505Z

NVD

Status : Received

Published: 2026-08-10T13:20:23.160

Modified: 2026-10-30T13:19:43.723

Link: CVE-2026-68329

Redhat

Severity : Moderate

Publid Date: 2026-08-10T12:03:05Z

Links: CVE-2026-68329 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-20T13:45:13Z

Weaknesses

CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CWE-367
Time-of-check Time-of-use (TOCTOU) Race Condition

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable no

Technical Impact total

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object