CVE-2026-74439

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the iommu/vt-d component where the device pasid table teardown() function zeroes a 128-bit scalable-mode context entry using context clear entry() while the Present bit remains set. This creates a race condition where hardware may fetch a torn entry—where some fields are zeroed but the Present bit is still active—potentially causing unpredictable behavior or spurious faults. Because context-cache invalidation occurs only after the entry is zeroed and intel pasid free table() subsequently frees the PASID directory pages, the IOMMU may continue to process a stale entry pointing to freed memory. This is exacerbated by the fact that the compiler may reorder 64-bit writes and hardware fetches are not guaranteed to be atomic relative to multiple CPU writes.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.