The Linux kernel vulnerability CVE-2026-89448 involves the iommu/vt-d subsystem where the detect_intel_iommu() function did not check for the presence of tboot, resulting in ACS not being requested when tboot was enabled. Since tboot_force_iommu() forces iommu on, this mismatch could cause ACS to be disabled unintentionally, potentially weakening IOMMU isolation. The fix involves modifying detect_intel_iommu() to include a check for tboot, ensuring ACS is requested appropriately.

The vulnerability could lead to a misconfiguration where Access Control Services (ACS) are disabled despite iommu being forced on by tboot, potentially reducing the effectiveness of IOMMU protections. This could affect system security by weakening device isolation and memory access controls. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel source code to address this issue by updating detect_intel_iommu() to check for tboot and force ACS request accordingly. Users should apply the official Linux kernel updates that include this fix. No additional mitigation steps are indicated.