CVE-2026-68329

A flaw was found in the Linux kernel's iommu/amd component. A race condition in the iommu_completion_wait() function allows it to return prematurely without ensuring all previously queued commands have completed in hardware. This can lead to a use-after-free vulnerability, where the Input/Output Memory Management Unit (IOMMU) might access freed page-table pages. A local attacker could potentially exploit this to cause system instability, escalate privileges, or disclose sensitive information.

This vulnerability is rated as Moderate impact because successful exploitation requires authenticated local access to systems running on AMD hardware and depends on winning a tight multi-threaded race condition to trigger memory corruption. In Red Hat Enterprise Linux environments, the AMD IOMMU driver manages device memory translation and DMA remapping, but the flaw is only exposed on hosts utilizing AMD processors with active IOMMU support. Unprivileged local users face significant technical barriers to intentionally orchestrate the concurrent command queue timing needed to exploit the stale translation state. Systems running on Intel hardware or non-x86 architectures are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.