FKIE_CVE-2026-90241

Vulnerability from fkie_nvd - Published: 2026-09-17 17:17 - Updated: 2026-09-18 18:17
Severity
8.2 (High) - CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Tear down scalable-mode context on probe failure intel_pasid_setup_sm_context() walks a PCI device’s DMA aliases via pci_for_each_dma_alias() and programs a scalable-mode context entry for each RID. For a device with a dma_alias_mask, the callback is invoked once for the device’s own RID and once for each alias bit, all with the same pci_dev, so device_pasid_table_setup() runs for multiple RIDs. pci_for_each_dma_alias() stops at the first callback error. Therefore, a failure partway through the walk can leave context entries for already processed RIDs present and still pointing to the device’s PASID table. On this error path, intel_iommu_probe_device() currently jumps directly to intel_pasid_free_table(), which frees the PASID table without first tearing down those context entries. The IOMMU may then walk a present context entry whose PASID table pointer references freed memory. intel_iommu_release_device() already performs teardown before freeing the table. Apply the same ordering on the probe failure path. device_pasid_table_teardown() safely handles RIDs that were never programmed: iommu_context_addr() returns NULL when no context table has been allocated, and clearing the Present bit of an already non-present entry is a no-op. So unwind is safe for both the alias that failed and any aliases not yet reached.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/25ac85a9747cd63e1d166ace7b360a2cd9479d9d
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/c509fb73a1093a15accd7d43a61645d4b520f6ac
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d0e978ced7429b516358bb4d41d337214768ae98
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/db5daf25f754cdc20c18525adb88240ece6fdee9
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/intel/iommu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "25ac85a9747cd63e1d166ace7b360a2cd9479d9d",
              "status": "affected",
              "version": "301f1a80487fd2f51012533792583d4425e8b8c0",
              "versionType": "git"
            },
            {
              "lessThan": "d0e978ced7429b516358bb4d41d337214768ae98",
              "status": "affected",
              "version": "301f1a80487fd2f51012533792583d4425e8b8c0",
              "versionType": "git"
            },
            {
              "lessThan": "db5daf25f754cdc20c18525adb88240ece6fdee9",
              "status": "affected",
              "version": "301f1a80487fd2f51012533792583d4425e8b8c0",
              "versionType": "git"
            },
            {
              "lessThan": "c509fb73a1093a15accd7d43a61645d4b520f6ac",
              "status": "affected",
              "version": "301f1a80487fd2f51012533792583d4425e8b8c0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/intel/iommu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: Tear down scalable-mode context on probe failure\n\nintel_pasid_setup_sm_context() walks a PCI device\u2019s DMA aliases via\npci_for_each_dma_alias() and programs a scalable-mode context entry for\neach RID. For a device with a dma_alias_mask, the callback is invoked\nonce for the device\u2019s own RID and once for each alias bit, all with the\nsame pci_dev, so device_pasid_table_setup() runs for multiple RIDs.\n\npci_for_each_dma_alias() stops at the first callback error. Therefore, a\nfailure partway through the walk can leave context entries for already\nprocessed RIDs present and still pointing to the device\u2019s PASID table.\n\nOn this error path, intel_iommu_probe_device() currently jumps directly\nto intel_pasid_free_table(), which frees the PASID table without\nfirst tearing down those context entries. The IOMMU may then walk a\npresent context entry whose PASID table pointer references freed\nmemory.\n\nintel_iommu_release_device() already performs teardown before freeing the\ntable. Apply the same ordering on the probe failure path.\n\ndevice_pasid_table_teardown() safely handles RIDs that were never\nprogrammed: iommu_context_addr() returns NULL when no context table has\nbeen allocated, and clearing the Present bit of an already non-present\nentry is a no-op. So unwind is safe for both the alias that failed and\nany aliases not yet reached."
    }
  ],
  "id": "CVE-2026-90241",
  "lastModified": "2026-09-18T18:17:50.390",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.5,
        "impactScore": 6.0,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-09-17T17:17:20.070",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/25ac85a9747cd63e1d166ace7b360a2cd9479d9d"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/c509fb73a1093a15accd7d43a61645d4b520f6ac"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/d0e978ced7429b516358bb4d41d337214768ae98"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/db5daf25f754cdc20c18525adb88240ece6fdee9"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.