Look up another CVE · open CVE-2026-68329 in the interactive tracker
CVE-2026-68329
iommu/amd: Wait for completion instead of returning early in iommu_completion_wait()
Published 2026-08-10 (2 months ago) by the Linux kernel CNA. Subsystem drivers/iommu. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-68329 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | vulnerable | 6.1.190-1 | No fix published anywhere yet, neither in Debian nor upstream for the series bookworm tracks. Watch the Debian tracker page for this CVE. Advisories for bookworm have historically landed a median of 23 days after publication. |
| Debian 13trixie | fixed | 6.12.101-1 | Update the kernel and reboot. Fixed in 6.12.101-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.6-1 | Update the kernel and reboot. Fixed in 7.1.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.6-1 | Update the kernel and reboot. Fixed in 7.1.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4745-1 · 2026-08-18 · text | 6.12.101-1~deb12u1 | Update the kernel and reboot. DLA-4745-1 shipped the fix on 2026-08-18, in 6.12.101-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
need_sync is a per-IOMMU flag shared by all domains and devices behind that IOMMU. It is set whenever a command is queued with sync == true and cleared when a completion-wait (CWAIT) command is queued. However, a cleared need_sync only means that a covering CWAIT has been queued, not that all previously queued commands have actually completed in hardware. iommu_completion_wait() read need_sync locklessly and returned early when it was false. This breaks the "block until all previously queued commands have completed" contract in a multi-CPU scenario: CPU2: queue inv-B => need_sync = true CPU1: queue CWAIT(N); need_sync = false; then wait_on_sem(N) CPU2: read need_sync == false => return 0 (no wait!) CPU2 returns without waiting for any sequence number even though its inv-B may not have completed yet (CWAIT(N), queued after inv-B, has not been signaled). CPU2 then proceeds to, for example, free page-table pages while the IOMMU can still walk stale translations, opening a use-after-free window. This is a logical race in the meaning of the flag, not a memory-visibility issue, so barriers alone do not help. Fix it without losing the optimization of avoiding redundant CWAIT commands: take iommu->lock before testing need_sync, and when it is false do not return early but wait for the last allocated sequence number (cmd_sem_val). Since need_sync == false implies no sync command was queued after the last CWAIT, that CWAIT is FIFO-ordered after every not-yet-completed command, so waiting for its sequence number guarantees all prior commands (possibly queued by another CPU) have completed. The common path with pending work is unchanged and no extra hardware command is issued.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/iommu/amd/iommu.c
- What this is
- AMD IOMMU (AMD-VI)MAINTAINERS section matched on drivers/iommu/amd/ · iommu@lists.linux.dev · Maintained
Check it on the machine
grep -w CONFIG_AMD_IOMMU /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.
- bookwormYnot built on amd64/cloud-amd64, arm64/arm64, arm64/cloud-arm64, arm64/rt/arm64, armhf/armmp, armhf/armmp-lpae, armhf/rt/armmp, i386/686, i386/686-pae, i386/rt/686-pae, ppc64el/powerpc64le
- trixieYnot built on amd64/cloud-amd64, arm64/arm64, arm64/arm64-16k, arm64/cloud-arm64, arm64/rt/arm64, armel/rpi, armhf/armmp, armhf/armmp-lpae, armhf/rt/armmp, ppc64el/powerpc64le, ppc64el/powerpc64le-64k, riscv64/riscv64, s390x/s390x
- forky, sidYnot built on amd64/cloud-amd64, arm64/arm64, arm64/arm64-16k, arm64/cloud-arm64, arm64/rt-arm64, armhf/armmp, armhf/armmp-lpae, loong64/loong64, ppc64el/powerpc64le, ppc64el/powerpc64le-64k, riscv64/riscv64, s390x/s390x
- bookworm · linux-6.12Ynot built on amd64/cloud-amd64, arm64/arm64, arm64/arm64-16k, arm64/cloud-arm64, arm64/rt/arm64, armhf/armmp, armhf/armmp-lpae, armhf/rt/armmp, ppc64el/powerpc64le, ppc64el/powerpc64le-64k
- Y
- built in where it is built at all; some flavours do not build it
- Build switch
- CONFIG_AMD_IOMMU
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-10 (2 months ago)source
- CVSS
- 8.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.16%, higher than 5.2% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- drivers/iommu
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 3.0 | 6.6.148 | ab7faf5a172e |
| 3.0 | 6.12.101 | 93494bd44639 |
| 3.0 | 6.18.42 | d053eb7e09e1 |
| 3.0 | 7.1.6 | 02f8cefa2ad9 |
| 3.0 | 7.2 | 1e75a8255f11 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4745-1 | 2026-08-18 | bookworm 6.12.101-1~deb12u1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The racy `iommu_completion_wait()` is reached through local DMA map/unmap activity — iommu-dma unmap paths, VFIO/IOMMUFD unmap ioctls, and domain attach/detach — all driven from the local system rather than from network input.
- AC:LAttack complexity, low
- The attacker drives both sides of the race by issuing concurrent unmap/flush operations on multiple CPUs against the same IOMMU, and can retry indefinitely; each hit frees page-table pages while translations are still live, so no condition outside the attacker's influence is required.
- PR:LPrivileges required, low
- An unprivileged local user can generate the concurrent IOMMU invalidation traffic needed via ordinary parallel I/O through DMA-API device paths; no root or capability in the init namespace is required, and privileged VFIO users are only one of several entry points.
- UI:NUser interaction, none
- The race is triggered purely by the attacker's own concurrent unmap/flush workload; no victim action such as mounting a filesystem or opening a file is needed.
- S:CScope, changed
- The failure defeats IOMMU isolation itself: page-table pages are freed and reused while the IOMMU can still walk them and stale IOTLB entries persist, so a device (including one assigned to a guest or an external peripheral) retains DMA access to host memory outside its domain, crossing the DMA/IOMMU security boundary.
- C:HConfidentiality impact, high
- Stale translations and use-after-free page tables let a device read host memory that was unmapped, freed, and reallocated to unrelated kernel or user data, yielding effectively arbitrary memory disclosure across the IOMMU boundary.
- I:HIntegrity impact, high
- The same stale translations permit device DMA writes into freed and reallocated pages, including page-table pages the IOMMU still walks, giving an arbitrary kernel-memory write primitive usable for control-flow hijacking and privilege escalation.
- A:HAvailability impact, high
- Use-after-free of page-table pages and DMA into reallocated memory corrupt kernel structures and generate IOMMU I/O page faults, leading to oops or panic and full loss of availability.