CVE-2026-43220

iommu/amd: serialize sequence allocation under concurrent TLB invalidations

published May 6, 2026

CVSS
—
EPSS
0%
Percentile
5.0
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

iommu/amd: serialize sequence allocation under concurrent TLB invalidations

With concurrent TLB invalidations, completion wait randomly gets timed out

because cmd_sem_val was incremented outside the IOMMU spinlock, allowing

CMD_COMPL_WAIT commands to be queued out of sequence and breaking the

ordering assumption in wait_on_sem().

Move the cmd_sem_val increment under iommu->lock so completion sequence

allocation is serialized with command queuing.

And remove the unnecessary return.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00162 · 5.0th percentile
Published
2026-05-06T11:28Z
EPSS history
Timeline
  • 06 MAY 11:28Z
    iommu/amd: serialize sequence allocation under concurrent TLB invalidations
    cvelistv5