CVE-2026-90244

A flaw was found in the Linux kernel. Specifically, within the iommu/dma component, a lack of proper locking in the VFIO type1 legacy container could allow concurrent access to the msi_page_list. This concurrent access can lead to data corruption of the msi_page_list, potentially causing system instability or a denial of service (DoS) condition.

A race in iommu_dma_get_msi_page can occur when VFIO type1 merges devices from different IOMMU groups into the same domain and those devices allocate software MSI pages in parallel. Different VFIO device fds can hold different group mutexes, so the existing group level locking does not serialize access to the shared msi_page_list. This can corrupt kernel list state and can lead at least to a local denial of service through a host kernel crash. For the CVSS the PR:L is used because reliable triggering requires local VFIO access or control of a VM with assigned devices, but does not necessarily require full host root privileges. The issue is not directly network reachable.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.