CVE-2026-90240

A flaw was found in the Linux kernel's IOMMU (Input/Output Memory Management Unit) / VT-d (Virtualization Technology for Directed I/O) component. When tearing down Direct Memory Access (DMA) aliases of a device, the system fails to flush the context cache with the correct Source ID (SID). This oversight can lead to the hardware using stale cached entries. In scalable mode, this could allow the IOMMU to access freed memory, potentially resulting in memory corruption or system instability.

Intel VT-d may fail to invalidate the correct IOMMU context cache entry when tearing down a DMA alias because the flush used the device requester ID instead of the SID of the alias being cleared. The stale cached context can remain usable after the in memory context entry is cleared, and in scalable mode it may still reference a PASID directory that has already been freed. This is a use after free candidate in IOMMU translation state rather than a simple warning or resource leak. For the CVSS the PR:L value is used because practical triggering can be possible from a local actor that can drive device assignment, device reset, detach, or other delegated device management paths, even if full host root is not always required in virtualized environments. The issue is not directly network reachable. Impact is at least local denial of service via IOMMU faults or memory corruption, and in the paranoid case may include confidentiality and integrity impact if stale DMA translation state can be abused.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.