---
id: CVE-2026-43161
title: >-
  iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable
  mode
summary: >-
  In the Linux kernel, the following vulnerability has been resolved:


  iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable
  mode


  PCIe endpoints with ATS enabled and passed through to userspace

  (e.g., QEMU, DPDK) …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 37764b952e1b39053defc7ebe5dcd8c4e3e78de9 <
    48b3f08e68b29a79527869cdde7298ca2a9b9646
  - >-
    Linux >= 37764b952e1b39053defc7ebe5dcd8c4e3e78de9 <
    e70d5feb10c5ba2bbf7ca400b8f39a2f82d653e8
  - >-
    Linux >= 37764b952e1b39053defc7ebe5dcd8c4e3e78de9 <
    bc0490ad9edf5c6f98e39fbbee2877b85261a5ae
  - >-
    Linux >= 37764b952e1b39053defc7ebe5dcd8c4e3e78de9 <
    42662d19839f34735b718129ea200e3734b07e50
  - Linux 99301a53a1378f8863ac7850b9589f997bb0e125
  - Linux 948ec6d003280d49aca49b366aa5cb140f87434d
  - Linux >= 5.12.19 < 5.13
  - Linux >= 5.13.4 < 5.14
  - Linux 5.14
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T15:29:59.644276Z'
published: '2026-05-06'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T15:32:34.545Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-43161'
references:
  - url: 'https://git.kernel.org/stable/c/48b3f08e68b29a79527869cdde7298ca2a9b9646'
  - url: 'https://git.kernel.org/stable/c/e70d5feb10c5ba2bbf7ca400b8f39a2f82d653e8'
  - url: 'https://git.kernel.org/stable/c/bc0490ad9edf5c6f98e39fbbee2877b85261a5ae'
  - url: 'https://git.kernel.org/stable/c/42662d19839f34735b718129ea200e3734b07e50'
tags:
  - cve.org
epss: 0.00122
epssPercentile: 0.01988
ingestedAt: '2026-11-06T15:54:04.022Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode

PCIe endpoints with ATS enabled and passed through to userspace
(e.g., QEMU, DPDK) can hard-lock the host when their link drops,
either by surprise removal or by a link fault.

Commit 4fc82cd907ac ("iommu/vt-d: Don't issue ATS Invalidation
request when device is disconnected") adds pci_dev_is_disconnected()
to devtlb_invalidation_with_pasid() so ATS invalidation is skipped
only when the device is being safely removed, but it applies only
when Intel IOMMU scalable mode is enabled.

With scalable mode disabled or unsupported, a system hard-lock
occurs when a PCIe endpoint's link drops because the Intel IOMMU
waits indefinitely for an ATS invalidation that cannot complete.

Call Trace:
 qi_submit_sync
 qi_flush_dev_iotlb
 __context_flush_dev_iotlb.part.0
 domain_context_clear_one_cb
 pci_for_each_dma_alias
 device_block_translation
 blocking_domain_attach_dev
 iommu_deinit_device
 __iommu_group_remove_device
 iommu_release_device
 iommu_bus_notifier
 blocking_notifier_call_chain
 bus_notify
 device_del
 pci_remove_bus_device
 pci_stop_and_remove_bus_device
 pciehp_unconfigure_device
 pciehp_disable_slot
 pciehp_handle_presence_or_link_change
 pciehp_ist

Commit 81e921fd3216 ("iommu/vt-d: Fix NULL domain on device release")
adds intel_pasid_teardown_sm_context() to intel_iommu_release_device(),
which calls qi_flush_dev_iotlb() and can also hard-lock the system
when a PCIe endpoint's link drops.

Call Trace:
 qi_submit_sync
 qi_flush_dev_iotlb
 __context_flush_dev_iotlb.part.0
 intel_context_flush_no_pasid
 device_pasid_table_teardown
 pci_pasid_table_teardown
 pci_for_each_dma_alias
 intel_pasid_teardown_sm_context
 intel_iommu_release_device
 iommu_deinit_device
 __iommu_group_remove_device
 iommu_release_device
 iommu_bus_notifier
 blocking_notifier_call_chain
 bus_notify
 device_del
 pci_remove_bus_device
 pci_stop_and_remove_bus_device
 pciehp_unconfigure_device
 pciehp_disable_slot
 pciehp_handle_presence_or_link_change
 pciehp_ist

Sometimes the endpoint loses connection without a link-down event
(e.g., due to a link fault); killing the process (virsh destroy)
then hard-locks the host.

Call Trace:
 qi_submit_sync
 qi_flush_dev_iotlb
 __context_flush_dev_iotlb.part.0
 domain_context_clear_one_cb
 pci_for_each_dma_alias
 device_block_translation
 blocking_domain_attach_dev
 __iommu_attach_device
 __iommu_device_set_domain
 __iommu_group_set_domain_internal
 iommu_detach_group
 vfio_iommu_type1_detach_group
 vfio_group_detach_container
 vfio_group_fops_release
 __fput

pci_dev_is_disconnected() only covers safe-removal paths;
pci_device_is_present() tests accessibility by reading
vendor/device IDs and internally calls pci_dev_is_disconnected().
On a ConnectX-5 (8 GT/s, x2) this costs ~70 µs.

Since __context_flush_dev_iotlb() is only called on
{attach,release}_dev paths (not hot), add pci_device_is_present()
there to skip inaccessible devices and avoid the hard-lock.

## Affected

- `Linux >= 37764b952e1b39053defc7ebe5dcd8c4e3e78de9 < 48b3f08e68b29a79527869cdde7298ca2a9b9646`
- `Linux >= 37764b952e1b39053defc7ebe5dcd8c4e3e78de9 < e70d5feb10c5ba2bbf7ca400b8f39a2f82d653e8`
- `Linux >= 37764b952e1b39053defc7ebe5dcd8c4e3e78de9 < bc0490ad9edf5c6f98e39fbbee2877b85261a5ae`
- `Linux >= 37764b952e1b39053defc7ebe5dcd8c4e3e78de9 < 42662d19839f34735b718129ea200e3734b07e50`
- `Linux 99301a53a1378f8863ac7850b9589f997bb0e125`
- `Linux 948ec6d003280d49aca49b366aa5cb140f87434d`
- `Linux >= 5.12.19 < 5.13`
- `Linux >= 5.13.4 < 5.14`
- `Linux 5.14`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.