CVE-2026-43130

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode<br /> <br /> Commit 4fc82cd907ac ("iommu/vt-d: Don&amp;#39;t issue ATS Invalidation<br /> request when device is disconnected") relies on<br /> pci_dev_is_disconnected() to skip ATS invalidation for<br /> safely-removed devices, but it does not cover link-down caused<br /> by faults, which can still hard-lock the system.<br /> <br /> For example, if a VM fails to connect to the PCIe device,<br /> "virsh destroy" is executed to release resources and isolate<br /> the fault, but a hard-lockup occurs while releasing the group fd.<br /> <br /> Call Trace:<br /> qi_submit_sync<br /> qi_flush_dev_iotlb<br /> intel_pasid_tear_down_entry<br /> device_block_translation<br /> blocking_domain_attach_dev<br /> __iommu_attach_device<br /> __iommu_device_set_domain<br /> __iommu_group_set_domain_internal<br /> iommu_detach_group<br /> vfio_iommu_type1_detach_group<br /> vfio_group_detach_container<br /> vfio_group_fops_release<br /> __fput<br /> <br /> Although pci_device_is_present() is slower than<br /> pci_dev_is_disconnected(), it still takes only ~70 µs on a<br /> ConnectX-5 (8 GT/s, x2) and becomes even faster as PCIe speed<br /> and width increase.<br /> <br /> Besides, devtlb_invalidation_with_pasid() is called only in the<br /> paths below, which are far less frequent than memory map/unmap.<br /> <br /> 1. mm-struct release<br /> 2. {attach,release}_dev<br /> 3. set/remove PASID<br /> 4. dirty-tracking setup<br /> <br /> The gain in system stability far outweighs the negligible cost<br /> of using pci_device_is_present() instead of pci_dev_is_disconnected()<br /> to decide when to skip ATS invalidation, especially under GDR<br /> high-load conditions.