{"id":"CVE-2026-89448","state":"PUBLISHED","title":"iommu/vt-d: Force requesting ACS when tboot is enabled","description":"In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: Force requesting ACS when tboot is enabled\n\nCurrently the conditions of requesting ACS in detect_intel_iommu()\ndon't include tboot, leading to a possible misconfiguration with ACS\ndisabled (e.g. due to user opts) while iommu is later forced on by\ntboot_force_iommu().\n\nFix it by checking tboot in detect_intel_iommu().","publishedAt":"2026-09-11T19:43:14.746Z","updatedAt":"2026-10-30T12:31:42.885Z","severity":{"score":9.3,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"5d990b627537e59a3a2f039ff588a4750e9c1a6a","status":"affected","lessThan":"3fd2b60ea9bd18348f5e971678f31041ef211047","versionType":"git"},{"version":"5d990b627537e59a3a2f039ff588a4750e9c1a6a","status":"affected","lessThan":"579eb867d3da63f3b5e32f235925e1daa7ec70d0","versionType":"git"},{"version":"5d990b627537e59a3a2f039ff588a4750e9c1a6a","status":"affected","lessThan":"aaeb81241e802c86be69394f72d49fde3f861fbb","versionType":"git"},{"version":"5d990b627537e59a3a2f039ff588a4750e9c1a6a","status":"affected","lessThan":"45705a6bfdb283f7b3b509010fd617b72f942537","versionType":"git"},{"version":"5d990b627537e59a3a2f039ff588a4750e9c1a6a","status":"affected","lessThan":"87bc611c6c98a41c00feb7b06b0c297dd141a2ae","versionType":"git"},{"version":"5d990b627537e59a3a2f039ff588a4750e9c1a6a","status":"affected","lessThan":"607432b2618b61df81134be0ef2562b8300c1216","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/iommu/intel/dmar.c","drivers/iommu/intel/iommu.c","drivers/iommu/intel/iommu.h"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"2.6.33","status":"affected"},{"version":"0","status":"unaffected","lessThan":"2.6.33","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.157","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.109","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.50","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.4","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/iommu/intel/dmar.c","drivers/iommu/intel/iommu.c","drivers/iommu/intel/iommu.h"]}],"references":["https://git.kernel.org/stable/c/3fd2b60ea9bd18348f5e971678f31041ef211047","https://git.kernel.org/stable/c/579eb867d3da63f3b5e32f235925e1daa7ec70d0","https://git.kernel.org/stable/c/aaeb81241e802c86be69394f72d49fde3f861fbb","https://git.kernel.org/stable/c/45705a6bfdb283f7b3b509010fd617b72f942537","https://git.kernel.org/stable/c/87bc611c6c98a41c00feb7b06b0c297dd141a2ae","https://git.kernel.org/stable/c/607432b2618b61df81134be0ef2562b8300c1216"],"weaknesses":[],"ingestedAt":"2026-10-30T12:50:04.827Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/89xxx/CVE-2026-89448.json","commit":"1f312381e38164a43607eebab851b151dd16861e","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-89448","state":"PUBLISHED","datePublished":"2026-09-11T19:43:14.746Z","dateUpdated":"2026-10-30T12:31:42.885Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-09-11T19:38:34.706Z"},"containers":{"cna":{"title":"iommu/vt-d: Force requesting ACS when tboot is enabled","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: Force requesting ACS when tboot is enabled\n\nCurrently the conditions of requesting ACS in detect_intel_iommu()\ndon't include tboot, leading to a possible misconfiguration with ACS\ndisabled (e.g. due to user opts) while iommu is later forced on by\ntboot_force_iommu().\n\nFix it by checking tboot in detect_intel_iommu()."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"5d990b627537e59a3a2f039ff588a4750e9c1a6a","status":"affected","lessThan":"3fd2b60ea9bd18348f5e971678f31041ef211047","versionType":"git"},{"version":"5d990b627537e59a3a2f039ff588a4750e9c1a6a","status":"affected","lessThan":"579eb867d3da63f3b5e32f235925e1daa7ec70d0","versionType":"git"},{"version":"5d990b627537e59a3a2f039ff588a4750e9c1a6a","status":"affected","lessThan":"aaeb81241e802c86be69394f72d49fde3f861fbb","versionType":"git"},{"version":"5d990b627537e59a3a2f039ff588a4750e9c1a6a","status":"affected","lessThan":"45705a6bfdb283f7b3b509010fd617b72f942537","versionType":"git"},{"version":"5d990b627537e59a3a2f039ff588a4750e9c1a6a","status":"affected","lessThan":"87bc611c6c98a41c00feb7b06b0c297dd141a2ae","versionType":"git"},{"version":"5d990b627537e59a3a2f039ff588a4750e9c1a6a","status":"affected","lessThan":"607432b2618b61df81134be0ef2562b8300c1216","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/iommu/intel/dmar.c","drivers/iommu/intel/iommu.c","drivers/iommu/intel/iommu.h"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"2.6.33","status":"affected"},{"version":"0","status":"unaffected","lessThan":"2.6.33","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.157","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.109","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.50","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.4","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/iommu/intel/dmar.c","drivers/iommu/intel/iommu.c","drivers/iommu/intel/iommu.h"]}],"references":[{"url":"https://git.kernel.org/stable/c/3fd2b60ea9bd18348f5e971678f31041ef211047"},{"url":"https://git.kernel.org/stable/c/579eb867d3da63f3b5e32f235925e1daa7ec70d0"},{"url":"https://git.kernel.org/stable/c/aaeb81241e802c86be69394f72d49fde3f861fbb"},{"url":"https://git.kernel.org/stable/c/45705a6bfdb283f7b3b509010fd617b72f942537"},{"url":"https://git.kernel.org/stable/c/87bc611c6c98a41c00feb7b06b0c297dd141a2ae"},{"url":"https://git.kernel.org/stable/c/607432b2618b61df81134be0ef2562b8300c1216"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":9.3,"baseSeverity":"CRITICAL"},"scenarios":[{"lang":"en","value":"AV:L - detect_intel_iommu() runs at boot from pci_iommu_alloc() and, when tboot later forces VT-d on, skips pci_request_acs(); a local PCIe/Thunderbolt DMA device or VFIO-passthrough guest can then spoof requester IDs and issue peer-to-peer DMA. This is not a network-protocol path.\nAC:L - On a tboot launch where intel_iommu=off, iommu=off, or default dmar_disabled skipped pci_request_acs(), ACS SV/RR/CR/UF/TB are never programmed; an attacker-controlled device can then deterministically perform P2P DMA or RID spoofing with no race or layout luck.\nPR:N - A malicious PCIe/Thunderbolt device or a tenant with an assigned passthrough/SR-IOV function issues the DMA itself and needs no host account, capability, or init-namespace root, matching other VT-d isolation-bypass scores for unauthenticated devices.\nUI:N - After the kernel boots with tboot-forced VT-d and ACS still disabled, the attacker’s device performs DMA on its own; no separate victim action such as mounting a filesystem or opening a file is required.\nS:C - Missing ACS lets a device spoof requester IDs and send peer-to-peer TLPs that never reach the IOMMU, crossing the device/host DMA isolation boundary that tboot forces VT-d on to enforce (IOMMU/DMA boundary bypass is Scope Changed).\nC:H - Without ACS source validation, request redirect, and translation blocking, a device can impersonate another requester ID or DMA to peer BARs, reading host or peer-device memory outside its IOMMU domain (arbitrary DMA disclosure).\nI:H - The same ACS gap yields DMA writes into host or peer-device memory, including ATS without translation blocking on external/untrusted ports, providing an arbitrary write primitive that can corrupt kernel memory and hijack control flow.\nA:H - Unchecked DMA writes and IOMMU-bypassing P2P traffic can corrupt kernel structures or provoke DMAR faults, oopses, and panics; any such host crash qualifies as High availability impact."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-30T12:31:42.885Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.33","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.33","versionEndExcluding":"6.6.157"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.33","versionEndExcluding":"6.12.109"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.33","versionEndExcluding":"6.18.50"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.33","versionEndExcluding":"7.2.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.33","versionEndExcluding":"7.3"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-89448","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-16T19:22:16.872682Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-16T19:26:38.787Z"}}]}}}