Linux Kernel EUVD-2026-32360

Requires local code execution with at least an unprivileged shell (CVSS PR:L) on a system running an affected Linux kernel on an Intel CPU with VT-d Scalable Mode enabled and PASID/SVA in active use - typically virtualization hosts, SR-IOV deployments, or systems exercising Intel SVM with accelerators (IDXD/DSA, GPUs). The attacker must be able to invoke the PASID teardown path (e.g., through a process bound to an SVA-capable device or a VFIO/IOMMUFD interface that permits PASID allocation) and win a tight race against concurrent IOMMU hardware fetches, reflected in CVSS AC:H. Limiting factors: no remote vector (AV:L), no exploitation on systems where VT-d is disabled or running in legacy (non-scalable) mode, no exploitation on non-Intel platforms, and no user interaction is required (UI:N) but successful triggering depends on hardware timing, making reliable weaponization difficult.

The CVSS 7.8 (AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) signals a high-severity local issue requiring low privileges and high attack complexity, with scope change reflecting that IOMMU corruption can affect protection domains beyond the attacker's process. However, EPSS is 0.02% (5th percentile) and there is no KEV listing and no public exploit identified at time of analysis, which is consistent with a hard-to-trigger hardware race rather than a turnkey LPE. Realistically this is a reliability/correctness fix with theoretical security implications (DMA isolation breakdown, spurious faults) that matters most on multi-tenant hosts using SVA/PASID - e.g., virtualization hosts and accelerator/SVM workloads - rather than typical endpoints. Tag-derived 'Information Disclosure' framing is plausible (torn reads could leak stale PASID context to hardware) but is not independently confirmed in the commit message, which emphasizes 'unpredictable behavior or spurious faults'; treat the impact characterization as inferred, not confirmed.

A local low-privileged user on a host with Intel VT-d Scalable Mode and PASID-based SVA enabled repeatedly binds and tears down PASID contexts (e.g., via an accelerator or vfio-mediated device) while a co-tenant performs DMA, racing the kernel's PASID-entry zeroing against an in-flight IOMMU fetch. The resulting torn read can yield spurious DMA faults, denial of service on the IOMMU, or potentially leave a stale Present bit set briefly, undermining DMA isolation between protection domains. No public proof-of-concept is identified, and the CVSS AC:H reflects that winning the hardware-timing race is non-trivial.