CVE-2026-89448

This flaw is in the Linux kernel's Intel VT-d IOMMU initialization code, where the decision to request PCIe Access Control Services (ACS) in detect_intel_iommu() did not account for tboot (Intel TXT trusted boot). If ACS was disabled (for example, via user-supplied kernel options) but the IOMMU was later force-enabled by tboot_force_iommu(), the system could run with the IOMMU on yet without ACS-enforced isolation, allowing PCIe device peer-to-peer DMA traffic to bypass DMA-remapping protections. An attacker with a malicious or compromised PCIe device, or equivalent local access, could read or modify system memory that the trusted-boot/IOMMU configuration was supposed to protect, impacting confidentiality, integrity, and availability (CVSS 9.3, local vector, changed scope). Affected systems are those running the affected Linux kernel on Intel VT-d hardware that are booted via tboot with ACS disabled. No public proof of concept exists and no exploitation in the wild has been reported.

What to do: Install kernel updates from your distribution once the fix is available and reboot, since this is addressed in the IOMMU initialization code. Audit hosts that boot with tboot for any boot parameters or firmware settings that disable ACS or DMA remapping, and verify via kernel logs that ACS is being requested on those systems. Systems not using tboot, or that have not disabled ACS, are not exposed to this specific misconfiguration.