From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3A37627F72C for ; Wed, 27 May 2026 12:20:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779884436; cv=none; b=pmac82yUR6srokgF7eSHWPw0yfy/RgTJkrlw7AEOdhZrdUjbBtfKJG2ifck0/YnLjvUot/+WUY1VJBFlb/1BZPOg2QIbe7jszbUu1bW4OISALRFmNZ2qzwps3IfOqx1bWLN99YD9Pb5+ai+VFCu9L5T4F/FnMacDyoeyTa4O4v0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779884436; c=relaxed/simple; bh=lzBEpPAG7q2tdT21XpOGXAnBEKWWPcwuhPgY7WBiGT0=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=ABYCNM/7d+egnRJcViggf3Gzf97hs+USG7mkp3qAk+wkkbU3OFzGrsQ7v4hBNZv1tR4HLW0Bke1DopUWvZna33aBe0ag7tGc6hL4VxyBCYSmWof5IfM8zXAzyTWba2Am4ZXozmoo7rqYsZVgs+znQfKOxNWQeaJYqAxp5tLNz7w= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=lodXR7M3; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="lodXR7M3" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 50AA31F00A3D; Wed, 27 May 2026 12:20:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1779884434; bh=QKs+WsxqU6tMRUT/QStb0MxtOlgwvHXVC3SBtpM9qv4=; h=From:To:Cc:Subject:Date:Reply-To; b=lodXR7M3wPFej6cum6umo7fjILFwt3cqsBg5jbdOI95aBz8lsC4tCZIicHBNjLKOd EPdCk4/i8kriNMYAnVuHicMdvK6jiCd7aT4EmXZ7kWMhKQhLVZ/yYPFCbGGsUu9spr tD3XxXf97GYzTLRvABJyoTi7wWA4elWrtqpXk2hw= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-45862: iommu/vt-d: Flush cache for PASID table before using it Date: Wed, 27 May 2026 14:18:24 +0200 Message-ID: <2026052711-CVE-2026-45862-6bdd@gregkh> X-Mailer: git-send-email 2.54.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3666; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=56T8V0jVXp2Y8NPCgDoAcmZ5VJ4SHv2bhufIDlqB+Oo=; b=kA0DAAIRMUfUDdst+ykByyZiAGoW4QOgoInSSpIAQnDgsi9CeIVOZP7rzhEBLOVPv4X4OwHCk ohdBAARAgAdFiEE9LYMxb94wiFKMT3LMUfUDdst+ykFAmoW4QMACgkQMUfUDdst+yktOQCgh0Mg w+0vHnSCML+65UHk4E0qjJYAoIJK5xyJxVtIxYL92sDkvI6TkWFL X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Flush cache for PASID table before using it When writing the address of a freshly allocated zero-initialized PASID table to a PASID directory entry, do that after the CPU cache flush for this PASID table, not before it, to avoid the time window when this PASID table may be already used by non-coherent IOMMU hardware while its contents in RAM is still some random old data, not zero-initialized. The Linux kernel CVE team has assigned CVE-2026-45862 to this issue. Affected and fixed versions =========================== Issue introduced in 5.10.175 with commit 7e00b52c8cdd9d3a985d63d72ecae7bde6314883 and fixed in 5.10.252 with commit cd75e77125c8a51754ca4cd60b4ca083ed735d1d Issue introduced in 5.15.103 with commit 5c65f097124770c3e5b9b83ed1a8b68c119bc7b5 and fixed in 5.15.202 with commit 0616137b70e6d9a547d4b60df8e1b64e36d83661 Issue introduced in 6.1.16 with commit 2bed9455db7cc0ab7ece6b3d846472097b52855a and fixed in 6.1.165 with commit 36990407cdd257473607e33802d00e978af2759e Issue introduced in 6.3 with commit 194b3348bdbb7db65375c72f3f774aee4cc6614e and fixed in 6.6.128 with commit c93f23375d8c410954b0df825e814b632fd62b9d Issue introduced in 6.3 with commit 194b3348bdbb7db65375c72f3f774aee4cc6614e and fixed in 6.12.75 with commit 5962c30a6f05ea1ab73f039e235bb30716243517 Issue introduced in 6.3 with commit 194b3348bdbb7db65375c72f3f774aee4cc6614e and fixed in 6.18.14 with commit 36244dfd3853f7bf89d03b8e90d56b23ce7fbc16 Issue introduced in 6.3 with commit 194b3348bdbb7db65375c72f3f774aee4cc6614e and fixed in 6.19.4 with commit d15cda135148ea7ba929cfdbcf208182bc29a7aa Issue introduced in 6.3 with commit 194b3348bdbb7db65375c72f3f774aee4cc6614e and fixed in 7.0 with commit 22d169bdd2849fe6bd18c2643742e1c02be6451c Issue introduced in 5.4.237 with commit 1b48c70feefc499b62670521efa002ab01e05df5 Issue introduced in 6.2.3 with commit bc348a6cc8f92e9979fbfbb3c6b48fd51b4b1dbf Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-45862 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/iommu/intel/pasid.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/cd75e77125c8a51754ca4cd60b4ca083ed735d1d https://git.kernel.org/stable/c/0616137b70e6d9a547d4b60df8e1b64e36d83661 https://git.kernel.org/stable/c/36990407cdd257473607e33802d00e978af2759e https://git.kernel.org/stable/c/c93f23375d8c410954b0df825e814b632fd62b9d https://git.kernel.org/stable/c/5962c30a6f05ea1ab73f039e235bb30716243517 https://git.kernel.org/stable/c/36244dfd3853f7bf89d03b8e90d56b23ce7fbc16 https://git.kernel.org/stable/c/d15cda135148ea7ba929cfdbcf208182bc29a7aa https://git.kernel.org/stable/c/22d169bdd2849fe6bd18c2643742e1c02be6451c