The Linux kernel vulnerability CVE-2026-90244 involves improper locking around the msi_page_list in the iommu/dma code. Specifically, VFIO type1's legacy container merges groups into a shared IOMMU domain, but the locking assumptions made for default domains do not hold. This allows concurrent calls to iommu_dma_get_msi_page() on the same merged domain, leading to corruption of the msi_page_list. The fix restores a static lock that was previously removed under the incorrect assumption that each iommu_domain is unique to a group. This lock protects the shared data structure in this specific scenario, preventing concurrent corruption.

Exploitation of this vulnerability can lead to corruption of kernel data structures related to MSI (Message Signaled Interrupts) handling in the IOMMU subsystem. The CVSS score of 7.8 indicates high severity with potential for confidentiality, integrity, and availability impacts. The flaw affects systems using VFIO type1 legacy containers with merged IOMMU domains, potentially causing system instability or compromise of device isolation.

A fix is available and has been applied in the Linux kernel by restoring the static lock around msi_page_list. Users should update to a kernel version that includes this patch. No additional mitigation steps are indicated by the vendor advisory.