CVE-2026-45944iommu/vt-d: Clear Present bit before tearing down context entry
- 7.5HighCVSS base score
- 0.12%Exploitation in 30 daysEPSS · top 98% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clear Present bit before tearing down context entry When tearing down a context entry, the current implementation zeros the entire 128-bit entry using multiple 64-bit writes. This creates a window where the hardware can fetch a "torn" entry — where some fields are already zeroed while the 'Present' bit is still set — leading to unpredictable behavior or spurious faults. While x86 provides strong write ordering, the compiler may reorder writes to the two 64-bit halves of the context entry. Even without compiler reordering, the hardware fetch is not guaranteed to be atomic with respect to multiple CPU writes. Align with the "Guidance to Software for Invalidations" in the VT-d spec (Section 6.5.3.3) by implementing the recommended ownership handshake: 1. Clear only the 'Present' (P) bit of the context entry first to signal the transition of ownership from hardware to software. 2. Use dma_wmb() to ensure the cleared bit is visible to the IOMMU. 3. Perform the required cache and context-cache invalidation to ensure hardware no longer has cached references to the entry. 4. Fully zero out the entry only after the invalidation is complete. Also, add a dma_wmb() to context_set_present() to ensure the entry is fully initialized before the 'Present' bit becomes visible.
Timeline
ID reserved
By Linux
- 14 days later
· 14 days later
Published
- 5 months later
· 5 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High7.5 | CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H |
| NVDNVD · Modified | 3.1 | High7.5 | CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.12% · top 98% of all CVEs (12 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.
Affected products
- affected ba39592764ed20cee09aae5352e603a27bf56b0d – < 61fa8546e39331103d6ce01575699c577d83e000
- affected ba39592764ed20cee09aae5352e603a27bf56b0d – < ab4aeab2d630e68be60ccbea3fcf76fa7c281a18
- affected ba39592764ed20cee09aae5352e603a27bf56b0d – < c716a59e9977d751e5eb54bcfa6a80124cb5067b
- affected ba39592764ed20cee09aae5352e603a27bf56b0d – < d2138abc8f0a7fce4101b7229b43b06811ed083d
- affected ba39592764ed20cee09aae5352e603a27bf56b0d – < a922dbafb4a674d958d702038232d09a30daf770
- affected ba39592764ed20cee09aae5352e603a27bf56b0d – < c1e4f1dccbe9d7656d1c6872ebeadb5992d0aaa2
- affected 2.6.24
- unaffected < 2.6.24
- unaffected 6.1.191 – ≤ 6.1.*
- unaffected 6.6.160 – ≤ 6.6.*
- unaffected 6.12.97 – ≤ 6.12.*
- unaffected 6.18.14 – ≤ 6.18.*
- unaffected 6.19.4 – ≤ 6.19.*
- unaffected 7.0 – ≤ *
References
References6
- https://git.kernel.org/stable/c/61fa8546e39331103d6ce01575699c577d83e000 (opens in a new tab)
- https://git.kernel.org/stable/c/ab4aeab2d630e68be60ccbea3fcf76fa7c281a18 (opens in a new tab)
- https://git.kernel.org/stable/c/c716a59e9977d751e5eb54bcfa6a80124cb5067b (opens in a new tab)
- https://git.kernel.org/stable/c/d2138abc8f0a7fce4101b7229b43b06811ed083d (opens in a new tab)
- https://git.kernel.org/stable/c/a922dbafb4a674d958d702038232d09a30daf770 (opens in a new tab)
- https://git.kernel.org/stable/c/c1e4f1dccbe9d7656d1c6872ebeadb5992d0aaa2 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-32228 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-45944)Record last updated .