Linux Kernel CVE-2026-45944

Exploitation requires local code execution on an x86 system with an Intel CPU whose VT-d IOMMU is enabled (intel_iommu=on, the default on most modern server and many desktop distributions), and the attacker must already hold High privileges sufficient to drive IOMMU context teardown - in practice root with CAP_SYS_ADMIN or equivalent control over VFIO/PCI device assignment or domain attach/detach paths. The CVSS vector's AC:H reflects that the attacker must also win a tight timing race between the kernel's multi-write teardown of a 128-bit context entry and an IOMMU hardware fetch, which requires concurrent DMA activity on the affected device. Exploitation is limited by: the need for prior High privileges (PR:H), high attack complexity (AC:H) due to the race window, the requirement that VT-d be enabled and a relevant device be assignable, no remote attack surface (AV:L), and the fact that systems without Intel VT-d hardware or with the IOMMU disabled are not affected.

The CVSS 3.1 vector (AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) yields 7.5 (High) but reflects a difficult exploitation profile: local access, high attack complexity, and high privileges are all required, with the high score driven primarily by the changed scope and high impact triad. EPSS corroborates the low practical risk at 0.02% (4th percentile), and the CVE is not listed on CISA KEV, with no public exploit identified at time of analysis. Real-world risk is therefore low - this is a kernel hardening fix for a hardware race condition that requires an already-privileged local actor (or an unusual concurrent kernel workload) to even reach the narrow window. The 'Information Disclosure' tag conflicts somewhat with a vector showing full C/I/A impact and scope change; the underlying defect is more accurately a stability/integrity issue in IOMMU teardown that could conceivably cause DMA isolation breakdown, so the tag should be treated as advisory rather than authoritative.

A local attacker who already holds high privileges (typically root/CAP_SYS_ADMIN, or an attacker who has compromised a virtualization control plane) triggers repeated IOMMU context teardown operations - for example by rapidly attaching and detaching a VFIO-bound PCI device or tearing down guest domains - while concurrent DMA traffic causes the hardware to fetch context entries. Winning the narrow race produces a torn context entry where the Present bit remains set over partially-zeroed fields, potentially leading to spurious DMA faults, kernel instability, or in adversarial scenarios a breakdown of DMA isolation that could be parlayed into memory disclosure or corruption. No public exploit identified at time of analysis, and the High attack complexity in the CVSS vector reflects that reliably hitting the race is non-trivial.