Linux Kernel CVE-2026-90240

Requires an Intel VT-d IOMMU operating in scalable mode (PASID tables) on hardware where the affected PCI device presents one or more DMA aliases (the flaw only manifests for aliases whose requester ID differs from the device's own RID). Exploitation is reached only through the teardown path - domain_context_clear_one() or device_pasid_table_teardown() - which is invoked when an IOMMU domain is destroyed or a device is unbound/detached (e.g., driver unbind, VFIO detach, hot-remove). Limiting factors: local access only (AV:L), the operation requires privileges to manage/detach devices (effectively CAP_SYS_ADMIN), no remote or unauthenticated path exists, and the vulnerable configuration is confined to Intel IOMMU scalable-mode deployments with aliasing devices on kernels 6.11 through the fixed stable releases.

The vendor CVSS of 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) overstates real-world risk for what is fundamentally a device-teardown memory-safety bug in the Intel VT-d IOMMU driver, not a data-exfiltration primitive. The tag 'Information Disclosure' is a mislabel: the actual defect is that a just-cleared context-cache entry for a DMA alias is never invalidated, so in scalable mode intel_pasid_free_table() can free a PASID directory still referenced by a stale cached entry, letting the IOMMU walk freed memory - this is a use-after-free / DMA-into-freed-memory condition (CWE-416/824) whose primary outcome is memory corruption and system crash, with only speculative confidentiality/integrity exposure via stale DMA translations. EPSS, KEV, and public POC signals are all ABSENT, consistent with a stable-tree kernel fix that reached the public via git.kernel.org commits with no observed exploitation. The attack vector is correctly local, but PR:L is optimistic: reaching the teardown path requires triggering IOMMU domain/PASID-table teardown (device unbind, VFIO detach, or hot-remove), which in practice needs device-management privileges (CAP_SYS_ADMIN). No SSVC or automatable data was provided. Net: a real but low-to-moderate-priority local kernel hardening fix, not a widely-exploitable network threat despite the 8.8 headline.

A local user with device-management privileges triggers teardown of an IOMMU domain for a PCI device that exposes DMA aliases (e.g., unbinding a device or detaching it from VFIO). Because the alias context-cache entries are flushed with the wrong requester ID, hardware keeps a stale context entry pointing at a freed PASID directory, and subsequent DMA causes the IOMMU to walk freed kernel memory, corrupting state or crashing the host. No public exploit code is identified at time of analysis.