« Volver al listado

CVE-2026-74439

Estado: RecibidaCrítica (9.3)—

In the Linux kernel, the following vulnerability has been resolved:

iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry

device_pasid_table_teardown() zeroes the 128-bit scalable-mode context entry with context_clear_entry() while the Present bit is still set. This creates a window where the hardware can fetch a torn entry, with some fields already zeroed while Present is still set, leading to unpredictable behavior or spurious faults. The context-cache invalidation is issued only after the entry has been zeroed, and intel_pasid_free_table() then frees the PASID directory pages, so the IOMMU can keep walking a stale Present=1 entry that points at freed memory.

Leer descripción completaMostrar menos

While x86 provides strong write ordering, the compiler may reorder the two 64-bit writes to the entry, and the hardware fetch is not guaranteed to be atomic with respect to multiple CPU writes.

Commit c1e4f1dccbe9d ("iommu/vt-d: Clear Present bit before tearing down context entry") fixed this exact pattern in domain_context_clear_one() and the copied-context path, but device_pasid_table_teardown() was not converted.

Align it with the "Guidance to Software for Invalidations" in the VT-d spec, Section 6.5.3.3, using the same ownership handshake as the sibling fix: clear only the Present bit, flush it to the IOMMU, perform the context-cache invalidation, and only then zero the rest of the entry.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:L sin UI justifica T1068. La vulnerabilidad permite al atacante local provocar comportamiento impredecible del IOMMU y corrupción de memoria al manipular entradas de contexto durante el desgarre, escalando privs y causando DoS o corrupción de datos.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence ProgramFilter Network TrafficExecution PreventionApplication Isolation and SandboxingExploit ProtectionUpdate Software

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-74439",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9.3,
          "attackVector": "LOCAL",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 2.5
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "81e921fd321614c2ad8ac333b041aae1da7a1c6d",
              "lessThan": "e9e83bcfe37dc719182500dd823c03ab57d934f0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "81e921fd321614c2ad8ac333b041aae1da7a1c6d",
              "lessThan": "588718101e8449605f1c7e858fecb7cfa701cdab",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "81e921fd321614c2ad8ac333b041aae1da7a1c6d",
              "lessThan": "7fd4077dc92b91b1b844333c0a06bb9e286db10a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "81e921fd321614c2ad8ac333b041aae1da7a1c6d",
              "lessThan": "f46452c3df7a8d8a5addc0926e76ef19ea7da0a0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "333fe86968482ca701c609af590003bcea450e8f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "6.8.2",
              "lessThan": "6.9",
              "versionType": "semver"
            }
          ],
          "programFiles": [
            "drivers/iommu/intel/pasid.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.9",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/iommu/intel/pasid.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-08-15T06:22:46.023",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/588718101e8449605f1c7e858fecb7cfa701cdab",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/7fd4077dc92b91b1b844333c0a06bb9e286db10a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e9e83bcfe37dc719182500dd823c03ab57d934f0",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f46452c3df7a8d8a5addc0926e76ef19ea7da0a0",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: Clear Present bit before tearing down scalable-mode context entry\n\ndevice_pasid_table_teardown() zeroes the 128-bit scalable-mode context\nentry with context_clear_entry() while the Present bit is still set. This\ncreates a window where the hardware can fetch a torn entry, with some\nfields already zeroed while Present is still set, leading to unpredictable\nbehavior or spurious faults. The context-cache invalidation is issued only\nafter the entry has been zeroed, and intel_pasid_free_table() then frees\nthe PASID directory pages, so the IOMMU can keep walking a stale Present=1\nentry that points at freed memory.\n\nWhile x86 provides strong write ordering, the compiler may reorder the two\n64-bit writes to the entry, and the hardware fetch is not guaranteed to be\natomic with respect to multiple CPU writes.\n\nCommit c1e4f1dccbe9d (\"iommu/vt-d: Clear Present bit before tearing down\ncontext entry\") fixed this exact pattern in domain_context_clear_one() and\nthe copied-context path, but device_pasid_table_teardown() was not\nconverted.\n\nAlign it with the \"Guidance to Software for Invalidations\" in the VT-d\nspec, Section 6.5.3.3, using the same ownership handshake as the sibling\nfix: clear only the Present bit, flush it to the IOMMU, perform the\ncontext-cache invalidation, and only then zero the rest of the entry."
    }
  ],
  "lastModified": "2026-08-17T06:19:39.613",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}