Skip to content
OpenAdvisories
Unscored CVE-2026-43161 EUVD-2026-27722GHSA-jph2-qvw9-vvwq

iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode

Published May 6, 2026 · Updated Nov 6, 2026 · Assigned by Linux

Vendor: Linux Product: Linux Package: kernel Package: linux Package: linux Package: linux-allwinner-5.19 Package: linux-aws Package: linux-aws-5.0 Package: linux-aws-5.11 Package: linux-aws-5.13 Package: linux-aws-5.15 Package: linux-aws-5.19 Package: linux-aws-5.3 Package: linux-aws-5.8 Package: linux-aws-6.14 Package: linux-aws-6.17 Package: linux-aws-6.2 Package: linux-aws-6.5 Package: linux-aws-6.8 Package: linux-aws-fips Package: linux-azure Package: linux-azure-5.11 Package: linux-azure-5.13 Package: linux-azure-5.15 Package: linux-azure-5.19 Package: linux-azure-5.3 Package: linux-azure-5.8 Package: linux-azure-6.11 Package: linux-azure-6.14 Package: linux-azure-6.17 Package: linux-azure-6.2 Package: linux-azure-6.5 Package: linux-azure-6.8 Package: linux-azure-edge Package: linux-azure-fde Package: linux-azure-fde-5.15 Package: linux-azure-fde-5.19 Package: linux-azure-fde-6.14 Package: linux-azure-fde-6.17 Package: linux-azure-fde-6.2 Package: linux-azure-fde-6.8 Package: linux-azure-fips Package: linux-azure-nvidia Package: linux-azure-nvidia-6.14 Package: linux-bluefield Package: linux-fips Package: linux-gcp Package: linux-gcp-5.11 Package: linux-gcp-5.13 Package: linux-gcp-5.15 Package: linux-gcp-5.19 Package: linux-gcp-5.3 Package: linux-gcp-5.8 Package: linux-gcp-6.11 Package: linux-gcp-6.14 Package: linux-gcp-6.17 Package: linux-gcp-6.2 Package: linux-gcp-6.5 Package: linux-gcp-6.8 Package: linux-gcp-fips Package: linux-gke Package: linux-gke-4.15 Package: linux-gke-5.15 Package: linux-gke-5.4 Package: linux-gkeop Package: linux-gkeop-5.15 Package: linux-gkeop-5.4 Package: linux-hwe Package: linux-hwe-5.11 Package: linux-hwe-5.13 Package: linux-hwe-5.15 Package: linux-hwe-5.19 Package: linux-hwe-5.8 Package: linux-hwe-6.11 Package: linux-hwe-6.14 Package: linux-hwe-6.17 Package: linux-hwe-6.2 Package: linux-hwe-6.5 Package: linux-hwe-6.8 Package: linux-hwe-edge Package: linux-ibm Package: linux-ibm-5.15 Package: linux-ibm-6.8 Package: linux-intel-5.13 Package: linux-intel-iot-realtime Package: linux-intel-iotg Package: linux-intel-iotg-5.15 Package: linux-kvm Package: linux-lowlatency Package: linux-lowlatency-hwe-5.15 Package: linux-lowlatency-hwe-5.19 Package: linux-lowlatency-hwe-6.11 Package: linux-lowlatency-hwe-6.2 Package: linux-lowlatency-hwe-6.5 Package: linux-lowlatency-hwe-6.8 Package: linux-nvidia Package: linux-nvidia-6.11 Package: linux-nvidia-6.17 Package: linux-nvidia-6.2 Package: linux-nvidia-6.5 Package: linux-nvidia-6.8 Package: linux-nvidia-lowlatency Package: linux-nvidia-tegra Package: linux-nvidia-tegra-5.15 Package: linux-nvidia-tegra-igx Package: linux-oem Package: linux-oem-5.10 Package: linux-oem-5.13 Package: linux-oem-5.14 Package: linux-oem-5.17 Package: linux-oem-5.6 Package: linux-oem-6.0 Package: linux-oem-6.1 Package: linux-oem-6.11 Package: linux-oem-6.14 Package: linux-oem-6.17 Package: linux-oem-6.5 Package: linux-oem-6.8 Package: linux-oracle Package: linux-oracle-5.0 Package: linux-oracle-5.11 Package: linux-oracle-5.13 Package: linux-oracle-5.15 Package: linux-oracle-5.3 Package: linux-oracle-5.8 Package: linux-oracle-6.14 Package: linux-oracle-6.17 Package: linux-oracle-6.5 Package: linux-oracle-6.8 Package: linux-raspi Package: linux-raspi-realtime Package: linux-raspi2 Package: linux-realtime Package: linux-realtime-6.14 Package: linux-realtime-6.17 Package: linux-realtime-6.8 Package: linux-riscv Package: linux-riscv-5.11 Package: linux-riscv-5.15 Package: linux-riscv-5.19 Package: linux-riscv-5.8 Package: linux-riscv-6.14 Package: linux-riscv-6.17 Package: linux-riscv-6.5 Package: linux-riscv-6.8 Package: linux-starfive-5.19 Package: linux-starfive-6.2 Package: linux-starfive-6.5 Package: linux-vmware Package: linux-xilinx Package: linux-xilinx-zynqmp Platform: Linux Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

In the Linux kernel, the following vulnerability has been resolved:

iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode

PCIe endpoints with ATS enabled and passed through to userspace
(e.g., QEMU, DPDK) can hard-lock the host when their link drops,
either by surprise removal or by a link fault.

Commit 4fc82cd907ac ("iommu/vt-d: Don't issue ATS Invalidation
request when device is disconnected") adds pci_dev_is_disconnected()
to devtlb_invalidation_with_pasid() so ATS invalidation is skipped
only when the device is being safely removed, but it applies only
when Intel IOMMU scalable mode is enabled.

With scalable mode disabled or unsupported, a system hard-lock
occurs when a PCIe endpoint's link drops because the Intel IOMMU
waits indefinitely for an ATS invalidation that cannot complete.

Call Trace:
qi_submit_sync
qi_flush_dev_iotlb
__context_flush_dev_iotlb.part.0
domain_context_clear_one_cb
pci_for_each_dma_alias
device_block_translation
blocking_domain_attach_dev
iommu_deinit_device
__iommu_group_remove_device
iommu_release_device
iommu_bus_notifier
blocking_notifier_call_chain
bus_notify
device_del
pci_remove_bus_device
pci_stop_and_remove_bus_device
pciehp_unconfigure_device
pciehp_disable_slot
pciehp_handle_presence_or_link_change
pciehp_ist

Commit 81e921fd3216 ("iommu/vt-d: Fix NULL domain on device release")
adds intel_pasid_teardown_sm_context() to intel_iommu_release_device(),
which calls qi_flush_dev_iotlb() and can also hard-lock the system
when a PCIe endpoint's link drops.

Call Trace:
qi_submit_sync
qi_flush_dev_iotlb
__context_flush_dev_iotlb.part.0
intel_context_flush_no_pasid
device_pasid_table_teardown
pci_pasid_table_teardown
pci_for_each_dma_alias
intel_pasid_teardown_sm_context
intel_iommu_release_device
iommu_deinit_device
__iommu_group_remove_device
iommu_release_device
iommu_bus_notifier
blocking_notifier_call_chain
bus_notify
device_del
pci_remove_bus_device
pci_stop_and_remove_bus_device
pciehp_unconfigure_device
pciehp_disable_slot
pciehp_handle_presence_or_link_change
pciehp_ist

Sometimes the endpoint loses connection without a link-down event
(e.g., due to a link fault); killing the process (virsh destroy)
then hard-locks the host.

Call Trace:
qi_submit_sync
qi_flush_dev_iotlb
__context_flush_dev_iotlb.part.0
domain_context_clear_one_cb
pci_for_each_dma_alias
device_block_translation
blocking_domain_attach_dev
__iommu_attach_device
__iommu_device_set_domain
__iommu_group_set_domain_internal
iommu_detach_group
vfio_iommu_type1_detach_group
vfio_group_detach_container
vfio_group_fops_release
__fput

pci_dev_is_disconnected() only covers safe-removal paths;
pci_device_is_present() tests accessibility by reading
vendor/device IDs and internally calls pci_dev_is_disconnected().
On a ConnectX-5 (8 GT/s, x2) this costs ~70 µs.

Since __context_flush_dev_iotlb() is only called on
{attach,release}_dev paths (not hot), add pci_device_is_present()
there to skip inaccessible devices and avoid the hard-lock.

Affected products

VendorProductAffectedFixed
Linux Linux 5.12.19 – < 5.13, 5.13.4 – < 5.14, 5.14 5.13

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 linux 6.19.6-1 —
Debian 13 linux 6.12.85-1 —
Debian 12 linux No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu Nvidia-BlueField 24.04 LTS linux-bluefield No fix yet —
Ubuntu Nvidia-BlueField 22.04 LTS linux-bluefield No fix yet —
Ubuntu 25.10 linux +8 No fix yet —
Ubuntu 24.04 LTS linux +44 No fix yet —
Ubuntu 22.04 LTS linux +59 No fix yet —
Show 9 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS linux-gke +28 No fix yet —
Ubuntu 18.04 LTS linux-gcp +14 No fix yet —
Ubuntu 16.04 LTS linux-hwe-edge No fix yet —
Ubuntu Pro Realtime 24.04 LTS linux-realtime +3 No fix yet —
Ubuntu Pro Realtime 22.04 LTS linux-realtime +2 No fix yet —
Ubuntu Pro FIPS-updates 24.04 LTS linux-fips +3 No fix yet —
Ubuntu Pro FIPS-updates 22.04 LTS linux-fips +3 No fix yet —
Ubuntu Pro FIPS-preview 22.04 LTS linux-fips +3 No fix yet —
Ubuntu Pro 20.04 LTS linux-aws-5.15 +10 No fix yet —
ReleasePackageFixed inAdvisory
SLES 15 SP7 kernel-64kb +7 6.4.0-150700.53.78.1 SUSE-SU-2026:3790-1
SLES 15 SP7 kernel-default-base 6.4.0-150700.53.78.1.150700.17.43.2 SUSE-SU-2026:3790-1
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 kernel-64kb +8 6.12.0-160000.36.1 SUSE-SU-2026:22835-1
SLES for SAP 16.0 kernel-default-base 6.12.0-160000.36.1.160000.2.17 SUSE-SU-2026:22835-1
SLES 16.0 kernel-64kb +8 6.12.0-160000.36.1 SUSE-SU-2026:22835-1, SUSE-SU-2026:22812-1
SLES 16.0 kernel-default-base 6.12.0-160000.36.1.160000.2.17 SUSE-SU-2026:22835-1
SLE Micro 6.2 kernel-default-base 6.12.0-160000.36.1.160000.2.17 SUSE-SU-2026:22769-1
SLE Micro 6.2 kernel-rt +5 6.12.0-160000.36.1 SUSE-SU-2026:22769-1, SUSE-SU-2026:22742-1
SLE Micro 6.1 kernel-rt +4 6.4.0-51.1 SUSE-SU-2026:23194-1, SUSE-SU-2026:23193-1
SLE Micro 6.0 kernel-rt +4 6.4.0-51.1 SUSE-SU-2026:23244-1, SUSE-SU-2026:23241-1
SLE Live Patching 15 SP7 kernel-default 6.4.0-150700.53.78.1 SUSE-SU-2026:3790-1
SLE Live Patching 15 SP7 kernel-livepatch-SLE15-SP7-RT_Update_19 1-150700.1.5.1 SUSE-SU-2026:3810-1
SLE Live Patching 15 SP7 kernel-livepatch-SLE15-SP7_Update_20 1-150700.15.3.2 SUSE-SU-2026:3790-1
SUSE Real Time Module 15 SP7 kernel-rt +2 6.4.0-150700.7.72.1 SUSE-SU-2026:3810-1
ReleasePackageFixed inAdvisory
openSUSE Leap 16.0 kernel-default-base 6.12.0-160000.36.1.160000.2.17 openSUSE-SU-2026:21388-1
openSUSE Leap 16.0 kernel-rt +11 6.12.0-160000.36.1 openSUSE-SU-2026:21388-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 kernel-livepatch-6.12.77-99.140 +1 1:1.0-0.amzn2023 ALAS2023-2026-1596, ALAS2023-2026-1543
Amazon Linux 2023 perf6.12 +14 1:6.12.77-99.140.amzn2023 ALAS2023-2026-1543
Amazon Linux 2023 perf6.18 +14 1:6.18.20-20.229.amzn2023 ALAS2023-2026-1596

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 kernel No fix yet —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 9 kernel-uek +34 6.12.0-204.92.4.2.el10uek ELSA-2026-50372

Advisories 15

References