{"api_version":"1","generated_at":"2026-10-01T13:40:28+00:00","cve":"CVE-2026-90241","urls":{"html":"https://cve.report/CVE-2026-90241","api":"https://cve.report/api/cve/CVE-2026-90241.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-90241","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-90241"},"summary":{"title":"iommu/vt-d: Tear down scalable-mode context on probe failure","description":"In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: Tear down scalable-mode context on probe failure\n\nintel_pasid_setup_sm_context() walks a PCI device’s DMA aliases via\npci_for_each_dma_alias() and programs a scalable-mode context entry for\neach RID. For a device with a dma_alias_mask, the callback is invoked\nonce for the device’s own RID and once for each alias bit, all with the\nsame pci_dev, so device_pasid_table_setup() runs for multiple RIDs.\n\npci_for_each_dma_alias() stops at the first callback error. Therefore, a\nfailure partway through the walk can leave context entries for already\nprocessed RIDs present and still pointing to the device’s PASID table.\n\nOn this error path, intel_iommu_probe_device() currently jumps directly\nto intel_pasid_free_table(), which frees the PASID table without\nfirst tearing down those context entries. The IOMMU may then walk a\npresent context entry whose PASID table pointer references freed\nmemory.\n\nintel_iommu_release_device() already performs teardown before freeing the\ntable. Apply the same ordering on the probe failure path.\n\ndevice_pasid_table_teardown() safely handles RIDs that were never\nprogrammed: iommu_context_addr() returns NULL when no context table has\nbeen allocated, and clearing the Present bit of an already non-present\nentry is a no-op. So unwind is safe for both the alias that failed and\nany aliases not yet reached.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-09-17 17:17:20","updated_at":"2026-09-18 18:17:50"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"8.2","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"8.2","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","data":{"baseScore":8.2,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/db5daf25f754cdc20c18525adb88240ece6fdee9","name":"https://git.kernel.org/stable/c/db5daf25f754cdc20c18525adb88240ece6fdee9","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/25ac85a9747cd63e1d166ace7b360a2cd9479d9d","name":"https://git.kernel.org/stable/c/25ac85a9747cd63e1d166ace7b360a2cd9479d9d","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/d0e978ced7429b516358bb4d41d337214768ae98","name":"https://git.kernel.org/stable/c/d0e978ced7429b516358bb4d41d337214768ae98","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/c509fb73a1093a15accd7d43a61645d4b520f6ac","name":"https://git.kernel.org/stable/c/c509fb73a1093a15accd7d43a61645d4b520f6ac","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-90241","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90241","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 301f1a80487fd2f51012533792583d4425e8b8c0 25ac85a9747cd63e1d166ace7b360a2cd9479d9d git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 301f1a80487fd2f51012533792583d4425e8b8c0 d0e978ced7429b516358bb4d41d337214768ae98 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 301f1a80487fd2f51012533792583d4425e8b8c0 db5daf25f754cdc20c18525adb88240ece6fdee9 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 301f1a80487fd2f51012533792583d4425e8b8c0 c509fb73a1093a15accd7d43a61645d4b520f6ac git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.9","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.9 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.110 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.52 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2.6 7.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3-rc1 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"90241","cve":"CVE-2026-90241","epss":"0.001700000","percentile":"0.067310000","score_date":"2026-09-21","updated_at":"2026-09-22 00:03:19"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/iommu/intel/iommu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"25ac85a9747cd63e1d166ace7b360a2cd9479d9d","status":"affected","version":"301f1a80487fd2f51012533792583d4425e8b8c0","versionType":"git"},{"lessThan":"d0e978ced7429b516358bb4d41d337214768ae98","status":"affected","version":"301f1a80487fd2f51012533792583d4425e8b8c0","versionType":"git"},{"lessThan":"db5daf25f754cdc20c18525adb88240ece6fdee9","status":"affected","version":"301f1a80487fd2f51012533792583d4425e8b8c0","versionType":"git"},{"lessThan":"c509fb73a1093a15accd7d43a61645d4b520f6ac","status":"affected","version":"301f1a80487fd2f51012533792583d4425e8b8c0","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/iommu/intel/iommu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.9"},{"lessThan":"6.9","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.110","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.52","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3-rc1","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.110","versionStartIncluding":"6.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.52","versionStartIncluding":"6.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.6","versionStartIncluding":"6.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3-rc1","versionStartIncluding":"6.9","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: Tear down scalable-mode context on probe failure\n\nintel_pasid_setup_sm_context() walks a PCI device’s DMA aliases via\npci_for_each_dma_alias() and programs a scalable-mode context entry for\neach RID. For a device with a dma_alias_mask, the callback is invoked\nonce for the device’s own RID and once for each alias bit, all with the\nsame pci_dev, so device_pasid_table_setup() runs for multiple RIDs.\n\npci_for_each_dma_alias() stops at the first callback error. Therefore, a\nfailure partway through the walk can leave context entries for already\nprocessed RIDs present and still pointing to the device’s PASID table.\n\nOn this error path, intel_iommu_probe_device() currently jumps directly\nto intel_pasid_free_table(), which frees the PASID table without\nfirst tearing down those context entries. The IOMMU may then walk a\npresent context entry whose PASID table pointer references freed\nmemory.\n\nintel_iommu_release_device() already performs teardown before freeing the\ntable. Apply the same ordering on the probe failure path.\n\ndevice_pasid_table_teardown() safely handles RIDs that were never\nprogrammed: iommu_context_addr() returns NULL when no context table has\nbeen allocated, and clearing the Present bit of an already non-present\nentry is a no-op. So unwind is safe for both the alias that failed and\nany aliases not yet reached."}],"metrics":[{"cvssV3_1":{"baseScore":8.2,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:L - intel_iommu_probe_device() is called from iommu_probe_device() on BUS_NOTIFY_ADD_DEVICE in iommu_bus_notifier; the Present context entries are programmed by intel_pasid_setup_sm_context() via pci_for_each_dma_alias() during that host probe, not by a remote protocol payload.\nAC:L - device_pasid_table_setup() can succeed for an earlier dma_alias_mask RID then fail when iommu_context_addr(..., true) GFP_ATOMIC-allocates the other scalable-mode context table; pci_for_each_dma_alias() stops, and the free_table path leaves those Present entries indefinitely, so a local attacker who induces that -ENOMEM does not need an uncontrolled race.\nPR:H - The free_table error path is reached only by adding or re-probing a PCI device into intel_iommu_probe_device(), which requires init-namespace CAP_SYS_ADMIN (pci-sysfs rescan is mode 0200 via dev_rescan_store, likewise remove/SR-IOV); user namespaces cannot trigger this IOMMU probe.\nUI:N - The attacker themselves issues the PCI add/rescan (or equivalent hotplug they control) that runs intel_iommu_probe_device(); no separate victim action such as mounting a filesystem is required.\nS:C - context_entry_set_pasid_table() leaves Present scalable-mode context entries pointing at the device PASID directory; intel_pasid_free_table() then frees that directory without teardown, so VT-d can translate DMA against reused host pages and bypass the IOMMU device/host isolation boundary.\nC:H - A Present context entry whose PASID table was freed by intel_pasid_free_table() is a translation-table use-after-free; reclaiming those pages lets a device DMA-read host physical memory outside its assigned domain.\nI:H - The same stale PASID-table pointer lets the device DMA-write host memory outside its domain, turning the probe-path UAF into an arbitrary write and potential control-flow hijack across the IOMMU boundary.\nA:H - Hardware walks of the freed PASID directory cause DMAR faults, kernel oops/panic, or host hangs; the unfixed free_table path is a use-after-free, which is A:H."}]}],"providerMetadata":{"dateUpdated":"2026-09-18T17:54:05.840Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/25ac85a9747cd63e1d166ace7b360a2cd9479d9d"},{"url":"https://git.kernel.org/stable/c/d0e978ced7429b516358bb4d41d337214768ae98"},{"url":"https://git.kernel.org/stable/c/db5daf25f754cdc20c18525adb88240ece6fdee9"},{"url":"https://git.kernel.org/stable/c/c509fb73a1093a15accd7d43a61645d4b520f6ac"}],"title":"iommu/vt-d: Tear down scalable-mode context on probe failure","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-90241","datePublished":"2026-09-17T16:07:45.168Z","dateReserved":"2026-09-11T19:38:34.795Z","dateUpdated":"2026-09-18T17:54:05.840Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-17 17:17:20","lastModifiedDate":"2026-09-18 18:17:50","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.5,"impactScore":6}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"90241","Ordinal":"1","Title":"iommu/vt-d: Tear down scalable-mode context on probe failure","CVE":"CVE-2026-90241","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"90241","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: Tear down scalable-mode context on probe failure\n\nintel_pasid_setup_sm_context() walks a PCI device’s DMA aliases via\npci_for_each_dma_alias() and programs a scalable-mode context entry for\neach RID. For a device with a dma_alias_mask, the callback is invoked\nonce for the device’s own RID and once for each alias bit, all with the\nsame pci_dev, so device_pasid_table_setup() runs for multiple RIDs.\n\npci_for_each_dma_alias() stops at the first callback error. Therefore, a\nfailure partway through the walk can leave context entries for already\nprocessed RIDs present and still pointing to the device’s PASID table.\n\nOn this error path, intel_iommu_probe_device() currently jumps directly\nto intel_pasid_free_table(), which frees the PASID table without\nfirst tearing down those context entries. The IOMMU may then walk a\npresent context entry whose PASID table pointer references freed\nmemory.\n\nintel_iommu_release_device() already performs teardown before freeing the\ntable. Apply the same ordering on the probe failure path.\n\ndevice_pasid_table_teardown() safely handles RIDs that were never\nprogrammed: iommu_context_addr() returns NULL when no context table has\nbeen allocated, and clearing the Present bit of an already non-present\nentry is a no-op. So unwind is safe for both the alias that failed and\nany aliases not yet reached.","Type":"Description","Title":"iommu/vt-d: Tear down scalable-mode context on probe failure"}]}}}