CVE-2026-90240
Description
A flaw was found in the Linux kernel's IOMMU (Input/Output Memory Management Unit) / VT-d (Virtualization Technology for Directed I/O) component. When tearing down Direct Memory Access (DMA) aliases of a device, the system fails to flush the context cache with the correct Source ID (SID). This oversight can lead to the hardware using stale cached entries. In scalable mode, this could allow the IOMMU to access freed memory, potentially resulting in memory corruption or system instability.
Statement
Intel VT-d may fail to invalidate the correct IOMMU context cache entry when tearing down a DMA alias because the flush used the device requester ID instead of the SID of the alias being cleared. The stale cached context can remain usable after the in memory context entry is cleared, and in scalable mode it may still reference a PASID directory that has already been freed. This is a use after free candidate in IOMMU translation state rather than a simple warning or resource leak. For the CVSS the PR:L value is used because practical triggering can be possible from a local actor that can drive device assignment, device reset, detach, or other delegated device management paths, even if full host root is not always required in virtualized environments. The issue is not directly network reachable. Impact is at least local denial of service via IOMMU faults or memory corruption, and in the paranoid case may include confidentiality and integrity impact if stale DMA translation state can be abused.
Mitigation
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7 | N/A | 8.8 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | High | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Changed |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
