CVE-2026-90241

A flaw was found in the Linux kernel's iommu/vt-d subsystem. During the setup of scalable-mode context entries for PCI devices, an error can occur that leaves behind invalid context entries. These entries may point to memory that has already been freed. An attacker could potentially exploit this to cause the IOMMU (Input/Output Memory Management Unit) to access freed memory, leading to system instability and a denial of service.

An Intel VT-d scalable mode probe failure can leave already programmed context entries present while their PASID table is freed. The IOMMU may later walk a present context entry whose PASID table pointer references freed memory, which makes this a use after free candidate in DMA translation state rather than a simple warning. For the CVSS the PR:H is used because reliable triggering normally requires privileged control over PCI device probing, driver binding, hotplug, SR-IOV setup, or similar host device management. The issue is not network reachable and requires local host side device control. Impact is at least denial of service and in the paranoid case may include confidentiality and integrity impact if the stale PASID table pointer causes incorrect DMA translations or memory corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.