CVE-2026-89448

A flaw was found in the Linux kernel's IOMMU (Input/Output Memory Management Unit) component. When tboot (Trusted Boot) is enabled, the system may fail to correctly request Access Control Services (ACS). This misconfiguration could potentially lead to a bypass of intended Access Control Services, which are designed to enforce security policies for I/O devices.

A protection mechanism failure in Intel VT-d setup can leave PCI ACS not requested when tboot later forces IOMMU on. This may weaken DMA and PCIe peer to peer isolation because the system can operate with IOMMU enabled but without the ACS configuration expected for device isolation. For the CVSS the PR:L is used for the paranoid score because practical exploitation may involve a local tenant, service account, or reduced privilege user with delegated access to a PCIe or passthrough device rather than full host administration. The issue is not directly network reachable and depends on tboot, Intel IOMMU, ACS capable topology, and attacker influence over a device path. Impact may include confidentiality and integrity loss through weakened DMA isolation, with possible availability impact if memory or device state is corrupted.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.