CVE-2026-74439

A flaw was found in the Linux kernel's Input/Output Memory Management Unit (IOMMU) subsystem. The device_pasid_table_teardown() function incorrectly clears a scalable-mode context entry while its 'Present' bit remains set. This creates a window where the hardware can access a partially cleared entry, potentially leading to unpredictable system behavior, spurious faults, or the IOMMU accessing freed memory. This vulnerability could result in system instability or a denial of service.

VT-d scalable mode context teardown can clear the full 128-bit context entry while the Present bit is still set. During this window the IOMMU may fetch a torn entry or continue walking a stale entry that references freed PASID directory pages, which is a use-after-free candidate in the DMA translation path. For the CVSS the PR:L is used for the paranoid score because reliable triggering may be possible for a local actor with delegated device or VFIO or PASID management access, even if many deployments restrict this to administrators. The issue is not network reachable. Impact is at least local denial of service through IOMMU faults or device malfunction, and in the worst defensible case may affect confidentiality and integrity if stale DMA translation state can be abused.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.