iommu/amd: Wait for completion instead of returning early in iommu_completion_wait()
In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() need_sync is a per-IOMMU flag shared by all domains and devices behind that IOMMU. It is set whenever a command is queued with sync == true and cleared when a completion-wait (CWAIT) command is queued. However, a cleared need_sync only means that a covering CWAIT has been queued, not that all previously queued commands have actually completed in hardware. iommu_completion_wait() read need_sync locklessly and returned early when it was false. This breaks the "block until all previously queued commands have completed" contract in a multi-CPU scenario: CPU2: queue inv-B => need_sync = true CPU1: queue CWAIT(N); need_sync = false; then wait_on_sem(N) CPU2: read need_sync == false => return 0 (no wait!) CPU2 returns without waiting for any sequence number even though its inv-B may not have completed yet (CWAIT(N), queued after inv-B, has not been signaled). CPU2 then proceeds to, for example, free page-table pages while the IOMMU can still walk stale translations, opening a use-after-free window. This is a logical race in the meaning of the flag, not a memory-visibility issue, so barriers alone do not help. Fix it without losing the optimization of avoiding redundant CWAIT commands: take iommu->lock before testing need_sync, and when it is false do not return early but wait for the last allocated sequence number (cmd_sem_val). Sin
CVE-2026-68329
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-68329
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "815b33fdc279d34ab40a8bfe1866623a4cc5669b",
"lessThan": "ab7faf5a172ebfdc423ebb3eea4d472740de82f9",
"versionType": "git"
},
{
"status": "affected",
"version": "815b33fdc279d34ab40a8bfe1866623a4cc5669b",
"lessThan": "93494bd446396c257fb589f59894577e96e406e2",
"versionType": "git"
},
{
"status": "affected",
"version": "815b33fdc279d34ab40a8bfe1866623a4cc5669b",
"lessThan": "d053eb7e09e10cbdca3fca8b35c1017d438091b2",
"versionType": "git"
},
{
"status": "affected",
"version": "815b33fdc279d34ab40a8bfe1866623a4cc5669b",
"lessThan": "02f8cefa2ad95ea3754f0cfd6fbae7f866202ccb",
"versionType": "git"
},
{
"status": "affected",
"version": "815b33fdc279d34ab40a8bfe1866623a4cc5669b",
"lessThan": "1e75a8255f11c81fb07e81e5029cfd75804350a0",
"versionType": "git"
}
],
"programFiles": [
"drivers/iommu/amd/iommu.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "3.0"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "3.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver",
"lessThanOrEqual": "7.1.*"
},
{
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/iommu/amd/iommu.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-68329
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #41697 · Revision 1
- Added to Heist Feed
- Publisher date