CVE-2026-90243

A flaw was found in the Linux kernel's IOMMU/VT-d subsystem. During the tear-down of copied context entries, the kernel zeroes out parts of an entry before clearing its "Present" bit and invalidating related caches. This timing issue allows hardware to fetch a partially cleared entry that is still marked as present, which can lead to unpredictable system behavior or spurious faults.

A VT-d copied context entry could be torn down by clearing the full 128 bit entry while the Present bit was still visible to hardware. During the window before context cache and IOTLB invalidation, the IOMMU could fetch a partially cleared entry and use inconsistent DMA remapping state. The realistic impact is local denial of service through spurious faults or unpredictable device translation behavior. For the CVSS the PR:L is used in the paranoid view because a reduced capability local actor may control a passed through device or VFIO style device context in some deployments. The issue is not network reachable and requires local device or IOMMU lifecycle interaction. In the worst defensible interpretation, inconsistent IOMMU context state may affect DMA isolation and could expose confidentiality or integrity risk in addition to availability impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.