The vulnerability in the Linux kernel's iommu/vt-d subsystem involved the device_pasid_table_teardown() function zeroing the 128-bit scalable-mode context entry while the Present bit remained set. This created a race condition where hardware could fetch a torn entry with some fields zeroed but Present still set, leading to unpredictable behavior or spurious faults. The context-cache invalidation was issued only after zeroing, and the PASID directory pages were freed, allowing the IOMMU to walk a stale Present=1 entry pointing to freed memory. The issue was due to potential compiler reordering of 64-bit writes and lack of atomicity in hardware fetches. The fix, consistent with Intel VT-d specification guidance, clears the Present bit first, flushes it to the IOMMU, performs context-cache invalidation, and only then zeroes the rest of the entry, preventing stale or torn entries from being used.

The vulnerability could lead to unpredictable hardware behavior or spurious faults due to the IOMMU fetching torn context entries with the Present bit still set. This may cause system instability or errors when the IOMMU accesses freed memory. No known exploits in the wild have been reported. The impact is primarily on system stability and correctness in environments using VT-d scalable-mode context entries.

A fix has been implemented in the Linux kernel to address this issue by properly clearing the Present bit before zeroing the context entry and performing context-cache invalidation as per Intel VT-d specifications. Users should update to the Linux kernel version that includes this fix. Patch status is not explicitly confirmed in the provided data; check the vendor advisory or Linux kernel changelogs for the exact fixed version and apply the update accordingly.