Linux Kernel EUVD-2026-27722

Exploitation requires all of the following conditions to be simultaneously present: (1) Intel VT-d IOMMU must be active on the host (intel_iommu=on kernel parameter or BIOS-enabled), and critically scalable mode must be disabled or unsupported by the hardware - systems with scalable mode active are protected by the prior fix in commit 4fc82cd907ac. (2) A PCIe endpoint with Address Translation Services (ATS) enabled must be assigned to userspace via VFIO/PCIe passthrough (e.g., QEMU guest or DPDK application). (3) The PCIe link to the assigned device must become inaccessible - through surprise hot-removal (PCIe slot ejection), a link-layer fault that does not generate a link-down event, or forcible process termination (e.g., virsh destroy, SIGKILL on DPDK process) while the link is degraded. Low-privilege local access (PR:L per CVSS) is sufficient because VFIO device assignment can be granted to non-root users. Exploitation is self-limiting in that it requires physical or operator control over device connectivity, and the attack surface is confined to virtualisation and high-performance I/O host configurations rather than general-purpose Linux deployments.

CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) accurately captures the local-only, availability-only nature of this vulnerability. The attack vector is local and requires low privileges, which significantly limits exposure - an attacker must already have local system access and control over a VFIO/PCIe passthrough device assignment. EPSS of 0.02% (5th percentile) reflects the highly specialised hardware and configuration prerequisites; widespread opportunistic exploitation is not realistic. The vulnerability is not listed in CISA KEV, and no public exploit or proof-of-concept has been identified. Despite the modest CVSS score, the real-world severity for affected deployments is high: the outcome is an unrecoverable host hard-lock requiring a power cycle, making it a critical operational risk for virtualisation hosts (KVM+QEMU) and high-performance packet-processing workloads (DPDK) that use PCIe passthrough with Intel VT-d but without scalable mode. The 'Information Disclosure' tag in the intelligence metadata appears misattributed - the actual impact is purely a denial of service (system freeze). There is no confidentiality or integrity impact confirmed from available data.

A local user or administrator on a KVM virtualisation host assigns a PCIe NIC (e.g., a Mellanox ConnectX-5) to a QEMU guest via VFIO with Intel VT-d non-scalable mode active. When the guest is forcibly terminated (virsh destroy) or the PCIe link degrades due to a hardware fault, the kernel attempts to flush the device IOTLB during teardown; because pci_device_is_present() is not called on this code path, qi_submit_sync() spins indefinitely waiting for an ATS completion from the now-inaccessible device, hard-locking the entire host. No exploit code is required beyond the standard VFIO passthrough workflow and a device disconnection event.