What is the CVSS score of CVE-2026-45945?

CVE-2026-45945 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Linux Kernel are affected by CVE-2026-45945?

A race condition in the Linux kernel's Intel VT-d IOMMU driver (CVE-2026-45945) allows local, low-privileged users to trigger inconsistent IOMMU state, potentially compromising DMA isolation and…. A patch is available.

How to fix or mitigate CVE-2026-45945?

24 HOURS: Identify all systems using Linux kernel with Intel VT-d IOMMU enabled (hypervisors, Kubernetes nodes, virtualization hosts). 7 DAYS: Apply vendor-released kernel patch to a canary set of non-production systems and verify stability. 30 DAYS: Complete patch deployment across all affected production systems, prioritizing virtualization infrastructure and high-density hypervisor environments.

Linux Kernel CVE-2026-45945

EUVD-2026-32229 HIGH

Race Condition (CWE-362)

2026-05-27 416baaa9-dc9f-4396-8d5f-8c081fb06d67

GHSA-3f6r-v6w8-rw99

Linux Information Disclosure Intel Race Condition

8.8

CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY

8.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 30, 2026 - 11:31 vuln.today

CVSS changed

May 30, 2026 - 11:22 NVD

8.8 (HIGH)

Patch available

May 27, 2026 - 19:46 EUVD

CVE Published

May 27, 2026 - 14:17 nvd

UNKNOWN (no severity yet)

CVE Published

May 27, 2026 - 14:17 nvd

HIGH 8.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

iommu/vt-d: Fix race condition during PASID entry replacement

The Intel VT-d PASID table entry is 512 bits (64 bytes). When replacing an active PASID entry (e.g., during domain replacement), the current implementation calculates a new entry on the stack and copies it to the table using a single structure assignment.

struct pasid_entry *pte, new_pte;

pte = intel_pasid_get_entry(dev, pasid); pasid_pte_config_first_level(iommu, &new_pte, ...); *pte = new_pte;

Because the hardware may fetch the 512-bit PASID entry in multiple 128-bit chunks, updating the entire entry while it is active (Present bit set) risks a "torn" read. In this scenario, the IOMMU hardware could observe an inconsistent state - partially new data and partially old data - leading to unpredictable behavior or spurious faults.

Fix this by removing the unsafe "replace" helpers and following the "clear-then-update" flow, which ensures the Present bit is cleared and the required invalidation handshake is completed before the new configuration is applied.

AnalysisAI

Race condition in the Linux kernel's Intel VT-d IOMMU driver allows a local low-privileged attacker to trigger inconsistent PASID table state during domain replacement, potentially producing spurious IOMMU faults and unpredictable DMA behavior with cross-scope impact. The flaw stems from non-atomic updates to 512-bit PASID entries while the Present bit is set, and no public exploit identified at time of analysis despite a high CVSS score driven by the scope-changed local attack surface.

Technical ContextAI

The Intel Virtualization Technology for Directed I/O (VT-d) IOMMU uses Process Address Space ID (PASID) table entries that are 512 bits (64 bytes) wide to map device DMA requests to per-process address spaces. The vulnerable code in drivers/iommu/intel/pasid.c performed an in-place structure assignment to replace an active PASID entry, but the IOMMU hardware fetches these entries in 128-bit chunks, so a concurrent hardware read could observe a torn state mixing old and new fields. This is a classic concurrent-access / atomicity violation (CWE-362-class race condition, though no CWE was assigned), specific to the clear-update-flush handshake required by the VT-d architecture when PASID entries are live.

RemediationAI

Upstream fix available (commits 66a7aff480a8 and c3b1edea3791) and vendor-released patch versions are Linux 6.19.4 and 7.0, which remove the unsafe replace helpers and enforce the clear-then-update flow with the required invalidation handshake before reprogramming the PASID entry - upgrade to one of these kernels or the equivalent backport from your distribution vendor. Where immediate patching is not feasible, compensating controls include disabling Intel VT-d / IOMMU PASID-dependent features such as SVA and SIOV via kernel command line (e.g., intel_iommu=off or disabling sva in the relevant driver), which eliminates the code path but breaks shared-virtual-memory accelerator workloads, GPU compute with SVM, and some SR-IOV/SIOV deployments. Restricting which users can load kernel modules and trigger device attach/detach (the events that drive PASID domain replacement) reduces the local trigger surface but does not close the race in unprivileged SVA workflows.

More in Intel

View all

CVE-2017-5689 CRITICAL Act Now POC

9.8 May 02

An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Mana

CVE-2012-5958 CRITICAL Act Now POC

10.0 Jan 31