---
id: CVE-2026-74439
title: 'iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry

  device_pasid_table_teardown() zeroes the 128-bit scalable-mode context
  entry with context…
severity: critical
cvss: 9.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 81e921fd321614c2ad8ac333b041aae1da7a1c6d <
    e9e83bcfe37dc719182500dd823c03ab57d934f0
  - >-
    Linux >= 81e921fd321614c2ad8ac333b041aae1da7a1c6d <
    588718101e8449605f1c7e858fecb7cfa701cdab
  - >-
    Linux >= 81e921fd321614c2ad8ac333b041aae1da7a1c6d <
    7fd4077dc92b91b1b844333c0a06bb9e286db10a
  - >-
    Linux >= 81e921fd321614c2ad8ac333b041aae1da7a1c6d <
    f46452c3df7a8d8a5addc0926e76ef19ea7da0a0
  - Linux 333fe86968482ca701c609af590003bcea450e8f
  - Linux >= 6.8.2 < 6.9
  - Linux 6.9
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T18:56:26.294835Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T19:05:45.325Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-74439'
references:
  - url: 'https://git.kernel.org/stable/c/e9e83bcfe37dc719182500dd823c03ab57d934f0'
  - url: 'https://git.kernel.org/stable/c/588718101e8449605f1c7e858fecb7cfa701cdab'
  - url: 'https://git.kernel.org/stable/c/7fd4077dc92b91b1b844333c0a06bb9e286db10a'
  - url: 'https://git.kernel.org/stable/c/f46452c3df7a8d8a5addc0926e76ef19ea7da0a0'
tags:
  - cve.org
epss: 0.00196
epssPercentile: 0.08643
ingestedAt: '2026-10-16T19:46:24.364Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry

device_pasid_table_teardown() zeroes the 128-bit scalable-mode context
entry with context_clear_entry() while the Present bit is still set. This
creates a window where the hardware can fetch a torn entry, with some
fields already zeroed while Present is still set, leading to unpredictable
behavior or spurious faults. The context-cache invalidation is issued only
after the entry has been zeroed, and intel_pasid_free_table() then frees
the PASID directory pages, so the IOMMU can keep walking a stale Present=1
entry that points at freed memory.

While x86 provides strong write ordering, the compiler may reorder the two
64-bit writes to the entry, and the hardware fetch is not guaranteed to be
atomic with respect to multiple CPU writes.

Commit c1e4f1dccbe9d ("iommu/vt-d: Clear Present bit before tearing down
context entry") fixed this exact pattern in domain_context_clear_one() and
the copied-context path, but device_pasid_table_teardown() was not
converted.

Align it with the "Guidance to Software for Invalidations" in the VT-d
spec, Section 6.5.3.3, using the same ownership handshake as the sibling
fix: clear only the Present bit, flush it to the IOMMU, perform the
context-cache invalidation, and only then zero the rest of the entry.

## Affected

- `Linux >= 81e921fd321614c2ad8ac333b041aae1da7a1c6d < e9e83bcfe37dc719182500dd823c03ab57d934f0`
- `Linux >= 81e921fd321614c2ad8ac333b041aae1da7a1c6d < 588718101e8449605f1c7e858fecb7cfa701cdab`
- `Linux >= 81e921fd321614c2ad8ac333b041aae1da7a1c6d < 7fd4077dc92b91b1b844333c0a06bb9e286db10a`
- `Linux >= 81e921fd321614c2ad8ac333b041aae1da7a1c6d < f46452c3df7a8d8a5addc0926e76ef19ea7da0a0`
- `Linux 333fe86968482ca701c609af590003bcea450e8f`
- `Linux >= 6.8.2 < 6.9`
- `Linux 6.9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.