What is the CVSS score of CVE-2026-89448?

CVE-2026-89448 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-89448?

A DMA-isolation misconfiguration in the Linux kernel's Intel VT-d IOMMU driver could allow peer-to-peer DMA attacks to bypass security isolation when Intel Trusted Boot (tboot) is active.. A patch is available.

How to fix or mitigate CVE-2026-89448?

Within 24 hours, identify all systems running Intel VT-d with tboot enabled and determine their current Linux kernel version to assess vulnerability scope. Within 7 days, develop a staging validation plan for the patched kernel version, test the update in non-production environments to confirm tboot and IOMMU remain functional, and document rollback procedures. Within 30 days, deploy the patched kernel across all affected systems according to your change management process, prioritizing systems in high-security or virtualized environments, and verify through kernel logs that ACS is properly enabled when tboot is active.

Linux Kernel CVE-2026-89448

EUVD-2026-76354 CRITICAL

2026-09-11 Linux

GHSA-mhhr-wjj6-vjmr

Information Disclosure Linux

9.3

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

9.3 CRITICAL

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local-only, requires the non-default tboot+ACS-disabled config (AC:H) and control of a DMA-capable device (PR:L); weakened isolation crosses a security boundary (S:C) with high memory-access impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Sep 13, 2026 - 07:56 vuln.today

CVSS changed

Sep 13, 2026 - 07:22 NVD

9.3 (CRITICAL)

Patch available

Sep 11, 2026 - 21:18 EUVD

CVE Published

Sep 11, 2026 - 19:43 cve.org

CRITICAL 9.3

CVE Published

Sep 11, 2026 - 19:43 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

iommu/vt-d: Force requesting ACS when tboot is enabled

Currently the conditions of requesting ACS in detect_intel_iommu() don't include tboot, leading to a possible misconfiguration with ACS disabled (e.g. due to user opts) while iommu is later forced on by tboot_force_iommu().

Fix it by checking tboot in detect_intel_iommu().

AnalysisAI

A DMA-isolation misconfiguration in the Linux kernel's Intel VT-d IOMMU driver (iommu/vt-d) allows Access Control Services (ACS) to remain disabled while the IOMMU is force-enabled by tboot. The detect_intel_iommu() routine did not account for trusted-boot state, so when a user opt disabled ACS but tboot_force_iommu() later forced the IOMMU on, peer-to-peer DMA isolation could be silently weaker than the platform intended. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Requires all of: an Intel VT-d (Intel IOMMU) platform; the system booting through tboot such that tboot_force_iommu() force-enables the IOMMU; and a user/administrator kernel option that disabled ACS (so detect_intel_iommu() did not request it). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The published CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H = 9.3) overstates real-world risk substantially. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Vendor-released patch: upgrade to Linux 6.12.109, 6.18.50, or 7.2.4 (or mainline 7.3-rc1 or later), applying whichever stable series matches your deployment. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, identify all systems running Intel VT-d with tboot enabled and determine their current Linux kernel version to assess vulnerability scope. …

Threat intelligence, references, and detailed analysis are available after sign-in.