Linux iommu/vt-d (dev-IOTLB flush for passed-through PCIe devices): The Intel IOMMU driver skips device-IOTLB

Impact

The Intel IOMMU driver skips device-IOTLB invalidation for PCIe endpoints that are ATS-enabled and passed through to userspace — the exact configuration used for SR-IOV NIC VFs handed to a VM, and for DPDK and RDMA userspace drivers on a GPU node. The device-IOTLB is the device's own cached copy of the address translations; if it is not flushed when a mapping is revoked, the device can keep reaching memory the kernel believes it has taken away. That is the core mechanism DMA isolation depends on, and passthrough NICs are precisely the devices you hand to untrusted tenants. Companion issue CVE-2026-43130 covers the scalable-mode variant.

Who can reach it

A tenant holding a passed-through, ATS-enabled PCIe device — an SR-IOV VF assigned to their VM, or a DPDK/RDMA userspace-bound NIC — able to exercise the device after a mapping has been torn down.

What to do

Kernel upgrade plus host reboot — rolling across every node that does device passthrough, which on a GPU cloud is all of them. Nothing to flash. If you cannot patch immediately, the meaningful mitigation is disabling ATS on passed-through endpoints (a BIOS/kernel-parameter change, at a measurable performance cost) or not passing devices through to untrusted tenants at all.

References