CVE-2026-45944

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> iommu/vt-d: Clear Present bit before tearing down context entry<br /> <br /> When tearing down a context entry, the current implementation zeros the<br /> entire 128-bit entry using multiple 64-bit writes. This creates a window<br /> where the hardware can fetch a "torn" entry — where some fields are<br /> already zeroed while the &amp;#39;Present&amp;#39; bit is still set — leading to<br /> unpredictable behavior or spurious faults.<br /> <br /> While x86 provides strong write ordering, the compiler may reorder writes<br /> to the two 64-bit halves of the context entry. Even without compiler<br /> reordering, the hardware fetch is not guaranteed to be atomic with<br /> respect to multiple CPU writes.<br /> <br /> Align with the "Guidance to Software for Invalidations" in the VT-d spec<br /> (Section 6.5.3.3) by implementing the recommended ownership handshake:<br /> <br /> 1. Clear only the &amp;#39;Present&amp;#39; (P) bit of the context entry first to<br /> signal the transition of ownership from hardware to software.<br /> 2. Use dma_wmb() to ensure the cleared bit is visible to the IOMMU.<br /> 3. Perform the required cache and context-cache invalidation to ensure<br /> hardware no longer has cached references to the entry.<br /> 4. Fully zero out the entry only after the invalidation is complete.<br /> <br /> Also, add a dma_wmb() to context_set_present() to ensure the entry<br /> is fully initialized before the &amp;#39;Present&amp;#39; bit becomes visible.