VulnerabilityPublished 6 May 2026Updated 6 Nov 2026

CVE-2026-43130: Linux kernel · iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in ead67d0378e90f419e385a43af29435242d80c12 : patch Linux kernel soon.

Data as of 6 Nov 2026, 16:04 UTC

Severity

High

Rated High by Threat Radar's AI analysis · No CVSS score from NVD or the CNA

Thin evidence

One scorer or none

Exploitation: No evidence of active exploitation and no public proof of concept
Automatable: Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact: Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-06.

Patch

Available – fixed in ead67d0378e90f419e385a43af29435242d80c12, e2c78c69f8faf2885ea4ceee08c71ac738f401a0, 9813306610d0d718c863aaa70928bf57d7570ec0 +11

Exploitation evidence

Disclosed: evidence found.
CVE published 6 May 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected >=5.10.214 <5.10.252 >=5.15.153 <5.15.202 >=6.1.83 <6.1.165 >=6.6.23 <6.6.128 >=6.7.11 <6.8 >=6.8.2 <6.9	Fixed in ead67d0378e90f419e385a43af29435242d80c12 e2c78c69f8faf2885ea4ceee08c71ac738f401a0 9813306610d0d718c863aaa70928bf57d7570ec0 581ce094d9eafb78ec4f9de77bd24b780c151236 10e60d87813989e20eac1f3eda30b3bae461e7f9 9deaacc8dcaddb6ddc5b52e1e63b457450ec0f94 6.9 6.8 6.6.128 6.1.165 5.15.202 5.10.252 01aed2f1d7cb8fdf4c60c5bb4727608cb82b401d 0da6697e577023d8867c7beb2d16a22510e4eea9
LinuxLinux	Affected =6.9	Fixed in–

AI-suggested

A fix is available and has been applied in Linux kernel versions 5.10.252, 5.15.202, 6.1.165, 6.6.128, 6.8, 6.9, and related intermediate versions. Users should upgrade to these fixed versions to resolve the issue. No additional mitigations are required as the patch addresses the root cause.

Description

A vulnerability in the Linux kernel's iommu/vt-d subsystem could cause a system hard-lock when flushing dev-IOTLB if a PCIe device is inaccessible due to link faults. The issue arises because the kernel incorrectly skips ATS invalidation based on device disconnection status, which does not cover link-down faults. This can lead to a hard lockup during resource release operations such as when a VM disconnects from a PCIe device. The fix involves changing the condition to flush dev-IOTLB only when the PCIe device is accessible in scalable mode, improving system stability with minimal performance impact.

Impact

The vulnerability can cause a system hard-lock (hard lockup) when the Linux kernel attempts to flush dev-IOTLB for PCIe devices that are inaccessible due to link faults but not fully disconnected. This affects virtual machine operations that release PCIe device resources, potentially causing system instability or crashes under certain fault conditions.

Summary

CVE-2026-43130 addresses a flaw in the Linux kernel's iommu/vt-d code where ATS invalidation requests were skipped based on pci_dev_is_disconnected(), which does not detect link-down faults caused by PCIe device errors. This flaw can cause a system hard-lock during operations like VM resource release (e.g., 'virsh destroy') when the PCIe device is inaccessible but not disconnected. The patch replaces pci_dev_is_disconnected() with pci_device_is_present() to more accurately detect device accessibility before flushing dev-IOTLB, thereby preventing hard lockups. The fix targets specific code paths that are infrequent, so the performance impact is negligible compared to the stability gain.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Nov 2026, 16:03 UTC

Technical details

References

Community reviews

Related threats