GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-45944 (GCVE-0-2026-45944)

Vulnerability from cvelistv5 – Published: 2026-05-27 12:18 – Updated: 2026-08-05 12:28
VLAI
Title
iommu/vt-d: Clear Present bit before tearing down context entry
Summary
In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clear Present bit before tearing down context entry When tearing down a context entry, the current implementation zeros the entire 128-bit entry using multiple 64-bit writes. This creates a window where the hardware can fetch a "torn" entry — where some fields are already zeroed while the 'Present' bit is still set — leading to unpredictable behavior or spurious faults. While x86 provides strong write ordering, the compiler may reorder writes to the two 64-bit halves of the context entry. Even without compiler reordering, the hardware fetch is not guaranteed to be atomic with respect to multiple CPU writes. Align with the "Guidance to Software for Invalidations" in the VT-d spec (Section 6.5.3.3) by implementing the recommended ownership handshake: 1. Clear only the 'Present' (P) bit of the context entry first to signal the transition of ownership from hardware to software. 2. Use dma_wmb() to ensure the cleared bit is visible to the IOMMU. 3. Perform the required cache and context-cache invalidation to ensure hardware no longer has cached references to the entry. 4. Fully zero out the entry only after the invalidation is complete. Also, add a dma_wmb() to context_set_present() to ensure the entry is fully initialized before the 'Present' bit becomes visible.
Severity
7.5 (High)
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: ba39592764ed20cee09aae5352e603a27bf56b0d , < c716a59e9977d751e5eb54bcfa6a80124cb5067b (git)
Affected: ba39592764ed20cee09aae5352e603a27bf56b0d , < d2138abc8f0a7fce4101b7229b43b06811ed083d (git)
Affected: ba39592764ed20cee09aae5352e603a27bf56b0d , < a922dbafb4a674d958d702038232d09a30daf770 (git)
Affected: ba39592764ed20cee09aae5352e603a27bf56b0d , < c1e4f1dccbe9d7656d1c6872ebeadb5992d0aaa2 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.24
Unaffected: 0 , < 2.6.24 (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.14 , ≤ 6.18.* (semver)
Unaffected: 6.19.4 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/intel/iommu.c",
            "drivers/iommu/intel/iommu.h",
            "drivers/iommu/intel/pasid.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c716a59e9977d751e5eb54bcfa6a80124cb5067b",
              "status": "affected",
              "version": "ba39592764ed20cee09aae5352e603a27bf56b0d",
              "versionType": "git"
            },
            {
              "lessThan": "d2138abc8f0a7fce4101b7229b43b06811ed083d",
              "status": "affected",
              "version": "ba39592764ed20cee09aae5352e603a27bf56b0d",
              "versionType": "git"
            },
            {
              "lessThan": "a922dbafb4a674d958d702038232d09a30daf770",
              "status": "affected",
              "version": "ba39592764ed20cee09aae5352e603a27bf56b0d",
              "versionType": "git"
            },
            {
              "lessThan": "c1e4f1dccbe9d7656d1c6872ebeadb5992d0aaa2",
              "status": "affected",
              "version": "ba39592764ed20cee09aae5352e603a27bf56b0d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/intel/iommu.c",
            "drivers/iommu/intel/iommu.h",
            "drivers/iommu/intel/pasid.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.24"
            },
            {
              "lessThan": "2.6.24",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.14",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.4",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: Clear Present bit before tearing down context entry\n\nWhen tearing down a context entry, the current implementation zeros the\nentire 128-bit entry using multiple 64-bit writes. This creates a window\nwhere the hardware can fetch a \"torn\" entry \u2014 where some fields are\nalready zeroed while the \u0027Present\u0027 bit is still set \u2014 leading to\nunpredictable behavior or spurious faults.\n\nWhile x86 provides strong write ordering, the compiler may reorder writes\nto the two 64-bit halves of the context entry. Even without compiler\nreordering, the hardware fetch is not guaranteed to be atomic with\nrespect to multiple CPU writes.\n\nAlign with the \"Guidance to Software for Invalidations\" in the VT-d spec\n(Section 6.5.3.3) by implementing the recommended ownership handshake:\n\n1. Clear only the \u0027Present\u0027 (P) bit of the context entry first to\n   signal the transition of ownership from hardware to software.\n2. Use dma_wmb() to ensure the cleared bit is visible to the IOMMU.\n3. Perform the required cache and context-cache invalidation to ensure\n   hardware no longer has cached references to the entry.\n4. Fully zero out the entry only after the invalidation is complete.\n\nAlso, add a dma_wmb() to context_set_present() to ensure the entry\nis fully initialized before the \u0027Present\u0027 bit becomes visible."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable setup/teardown paths are reached via local IOMMU domain management (VFIO/iommufd device assignment or sysfs driver bind/unbind); there is no network or adjacent-network path to this code.\nAC:H - Manifesting the torn-entry requires the IOMMU hardware to fetch the context entry in a microscopic window between the CPU writes and the cache/context-cache invalidation, combined with compiler/CPU write reordering \u2014 timing conditions the attacker cannot reliably control.\nPR:H - Driving an IOMMU context setup/teardown requires CAP_SYS_ADMIN-level privilege (VFIO/iommufd assignment or sysfs driver unbind), which is not obtainable through user namespaces.\nUI:N - The teardown/setup window is reached purely through IOMMU control operations with no victim action required.\nS:C - The IOMMU is the DMA isolation boundary; a torn/stale context entry lets a device\u0027s in-flight DMA be mistranslated and escape its assigned domain, impacting memory belonging to a different security authority (the host or another domain).\nC:H - A device using a stale/torn translation during the window can read host memory outside its intended domain across the IOMMU boundary, yielding a potential arbitrary device-driven read.\nI:H - The same cross-boundary mistranslation lets the device write host memory outside its domain, providing an arbitrary device-driven write primitive.\nA:H - The commit documents \"unpredictable behavior or spurious faults\"; torn-entry fetches generate DMAR fault storms and device/driver malfunction that can hang or crash the system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:28:51.029Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c716a59e9977d751e5eb54bcfa6a80124cb5067b"
        },
        {
          "url": "https://git.kernel.org/stable/c/d2138abc8f0a7fce4101b7229b43b06811ed083d"
        },
        {
          "url": "https://git.kernel.org/stable/c/a922dbafb4a674d958d702038232d09a30daf770"
        },
        {
          "url": "https://git.kernel.org/stable/c/c1e4f1dccbe9d7656d1c6872ebeadb5992d0aaa2"
        }
      ],
      "title": "iommu/vt-d: Clear Present bit before tearing down context entry",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-45944",
    "datePublished": "2026-05-27T12:18:00.481Z",
    "dateReserved": "2026-05-13T15:03:33.087Z",
    "dateUpdated": "2026-08-05T12:28:51.029Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-45944",
      "date": "2026-09-15",
      "epss": "0.00127",
      "percentile": "0.02671"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-10T14:55:15.000Z",
      "cve": "CVE-2026-45944",
      "id": "msrc_CVE-2026-45944",
      "initial_release_date": "2026-05-28T01:05:48.000Z",
      "product_status:known_affected": "6",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "iommu/vt-d: Clear Present bit before tearing down context entry",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-45944.json",
      "version": "7"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-45944\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-27T14:17:10.677\",\"lastModified\":\"2026-07-24T15:17:21.957\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\niommu/vt-d: Clear Present bit before tearing down context entry\\n\\nWhen tearing down a context entry, the current implementation zeros the\\nentire 128-bit entry using multiple 64-bit writes. This creates a window\\nwhere the hardware can fetch a \\\"torn\\\" entry \u2014 where some fields are\\nalready zeroed while the \u0027Present\u0027 bit is still set \u2014 leading to\\nunpredictable behavior or spurious faults.\\n\\nWhile x86 provides strong write ordering, the compiler may reorder writes\\nto the two 64-bit halves of the context entry. Even without compiler\\nreordering, the hardware fetch is not guaranteed to be atomic with\\nrespect to multiple CPU writes.\\n\\nAlign with the \\\"Guidance to Software for Invalidations\\\" in the VT-d spec\\n(Section 6.5.3.3) by implementing the recommended ownership handshake:\\n\\n1. Clear only the \u0027Present\u0027 (P) bit of the context entry first to\\n   signal the transition of ownership from hardware to software.\\n2. Use dma_wmb() to ensure the cleared bit is visible to the IOMMU.\\n3. Perform the required cache and context-cache invalidation to ensure\\n   hardware no longer has cached references to the entry.\\n4. Fully zero out the entry only after the invalidation is complete.\\n\\nAlso, add a dma_wmb() to context_set_present() to ensure the entry\\nis fully initialized before the \u0027Present\u0027 bit becomes visible.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/iommu/intel/iommu.c\",\"drivers/iommu/intel/iommu.h\",\"drivers/iommu/intel/pasid.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"ba39592764ed20cee09aae5352e603a27bf56b0d\",\"lessThan\":\"c716a59e9977d751e5eb54bcfa6a80124cb5067b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ba39592764ed20cee09aae5352e603a27bf56b0d\",\"lessThan\":\"d2138abc8f0a7fce4101b7229b43b06811ed083d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ba39592764ed20cee09aae5352e603a27bf56b0d\",\"lessThan\":\"a922dbafb4a674d958d702038232d09a30daf770\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ba39592764ed20cee09aae5352e603a27bf56b0d\",\"lessThan\":\"c1e4f1dccbe9d7656d1c6872ebeadb5992d0aaa2\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/iommu/intel/iommu.c\",\"drivers/iommu/intel/iommu.h\",\"drivers/iommu/intel/pasid.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.24\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.24\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.97\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.14\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19.4\",\"lessThanOrEqual\":\"6.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":0.8,\"impactScore\":6.0}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.6.24\",\"versionEndExcluding\":\"6.18.14\",\"matchCriteriaId\":\"76584304-2512-4344-9D16-2AFB7DFBC57F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.4\",\"matchCriteriaId\":\"672A3E79-EC03-479D-8503-361DFBDC8092\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/a922dbafb4a674d958d702038232d09a30daf770\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c1e4f1dccbe9d7656d1c6872ebeadb5992d0aaa2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c716a59e9977d751e5eb54bcfa6a80124cb5067b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d2138abc8f0a7fce4101b7229b43b06811ed083d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-02T21:30:56+00:00",
      "cve": "CVE-2026-45944",
      "id": "CVE-2026-45944",
      "initial_release_date": "2026-05-27T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: iommu/vt-d: Clear Present bit before tearing down context entry",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45944.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-11T01:14:00Z",
      "cve": "CVE-2026-45944",
      "id": "CVE-2026-45944",
      "initial_release_date": "2026-05-28T03:55:42Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "732",
      "product_status:recommended": "250",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-45944",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-45944.json",
      "version": "13"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.