Skip to main content

Linux Kernel CVE-2026-43220

| EUVDEUVD-2026-27780 MEDIUM
2026-05-06 Linux GHSA-v974-2cjf-22q5
Linux Amd Information Disclosure
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local-only kernel race in AMD IOMMU subsystem; low-privilege trigger sufficient; pure availability DoS with no confidentiality or integrity impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jul 24, 2026 - 01:01 vuln.today
CVSS changed
May 12, 2026 - 19:22 NVD
5.5 (MEDIUM)
Patch available
May 06, 2026 - 13:32 EUVD
CVE Published
May 06, 2026 - 11:28 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

iommu/amd: serialize sequence allocation under concurrent TLB invalidations

With concurrent TLB invalidations, completion wait randomly gets timed out because cmd_sem_val was incremented outside the IOMMU spinlock, allowing CMD_COMPL_WAIT commands to be queued out of sequence and breaking the ordering assumption in wait_on_sem(). Move the cmd_sem_val increment under iommu->lock so completion sequence allocation is serialized with command queuing. And remove the unnecessary return.

AnalysisAI

Denial of service in the Linux kernel AMD IOMMU subsystem allows a local low-privileged user to crash or stall IOMMU completion waits on systems with AMD hardware and IOMMU enabled. The root cause is a race condition where cmd_sem_val was incremented outside the IOMMU spinlock, permitting CMD_COMPL_WAIT commands to queue out of order and breaking the ordering invariant in wait_on_sem() under concurrent TLB invalidations. No public exploit or active exploitation has been identified; EPSS stands at 0.02% (4th percentile), reflecting negligible real-world exploitation probability at time of analysis.

Technical ContextAI

The AMD IOMMU (AMD-Vi) subsystem in the Linux kernel manages memory address translation for DMA operations on systems with AMD processors. The vulnerability is in the IOMMU command ring's completion signaling mechanism: cmd_sem_val is a sequence counter used to track which CMD_COMPL_WAIT command to block on in wait_on_sem(). Because this counter was incremented outside the iommu->lock spinlock, concurrent threads could race to allocate sequence numbers, causing completion-wait commands to be submitted out of order and the waiting thread to either time out or wait on an incorrect sequence. The fix serializes cmd_sem_val increments under iommu->lock. Although no CWE is formally assigned, this is structurally equivalent to CWE-362 (concurrent execution using shared resource with improper synchronization). Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.

RemediationAI

Apply the upstream kernel fixes available at the following kernel.org stable commits: https://git.kernel.org/stable/c/5000ce7fcb31067566a1a1a2e5b5bbff93625242, https://git.kernel.org/stable/c/48caa7542a795c9679ec1bd1bc2592e05a7369a4, https://git.kernel.org/stable/c/9e249c48412828e807afddc21527eb734dc9bd3d, https://git.kernel.org/stable/c/fca7aa0264ae99e5ff287d0ced5af0b82b121c4f, and https://git.kernel.org/stable/c/d51bf43193b1e95dc4e34e540dc76e19def2ae5a. Exact patched distribution package versions for Red Hat and SUSE are not confirmed from the available references; monitor vendor security advisories for specific kernel package updates. As a compensating control where immediate patching is not feasible, disabling AMD IOMMU via the kernel boot parameter amd_iommu=off eliminates the vulnerable code path, but note this also removes IOMMU-based DMA isolation for devices, weakening the host's protection against malicious or buggy hardware - this trade-off is significant on virtualization hosts running untrusted device pass-through workloads.

More in Amd

View all
CVE-2021-22986 CRITICAL POC
9.8 Mar 31

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.
CVE-2020-6103 CRITICAL POC
9.9 Jul 20

An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.
CVE-2020-6102 CRITICAL POC
9.9 Jul 20

An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.
CVE-2020-6101 CRITICAL POC
9.9 Jul 20

An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.
CVE-2020-6100 CRITICAL POC
9.9 Jul 20

An exploitable memory corruption vulnerability exists in AMD atidxx64.dll 26.20.15019.19000 graphics driver. Rated criti
CVE-2018-6546 CRITICAL POC
9.8 Apr 13

plays_service.exe in the plays.tv service before 1.27.7.0, as distributed in AMD driver-installation packages and Gaming
CVE-2021-3653 HIGH POC
8.8 Sep 29

A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. Rated high severity (CVSS 8.8), this vu
CVE-2020-12138 HIGH POC
8.8 Apr 27

AMD ATI atillk64.sys 5.11.9.0 allows low-privileged users to interact directly with physical memory by calling one of se
CVE-2019-5098 HIGH POC
8.6 Dec 05

An exploitable out-of-bounds read vulnerability exists in AMD ATIDXX64.DLL driver, version 26.20.13001.29010. Rated high
CVE-2015-7724 HIGH POC
7.8 Jun 07

AMD fglrx-driver before 15.9 allows local users to gain privileges via a symlink attack. Rated high severity (CVSS 7.8),
CVE-2015-7723 HIGH POC
7.8 Jun 07

AMD fglrx-driver before 15.7 allows local users to gain privileges via a symlink attack. Rated high severity (CVSS 7.8),
CVE-2023-1048 HIGH POC
7.8 Feb 26

A vulnerability, which was classified as critical, has been found in TechPowerUp Ryzen DRAM Calculator 1.2.0.5.sys. Rate

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-43220 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy