CVE-2026-89448iommu/vt-d: Force requesting ACS when tboot is enabled
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Force requesting ACS when tboot is enabled Currently the conditions of requesting ACS in detect_intel_iommu() don't include tboot, leading to a possible misconfiguration with ACS disabled (e.g. due to user opts) while iommu is later forced on by tboot_force_iommu(). Fix it by checking tboot in detect_intel_iommu().
- CVSS
- 9.3 CRITICAL (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 5d990b627537e59a3a2f039ff588a4750e9c1a6a before 579eb867d3da63f3b5e32f235925e1daa7ec70d0; from 5d990b627537e59a3a2f039ff588a4750e9c1a6a before aaeb81241e802c86be69394f72d49fde3f861fbb; from 5d990b627537e59a3a2f039ff588a4750e9c1a6a before 45705a6bfdb283f7b3b509010fd617b72f942537; from 5d990b627537e59a3a2f039ff588a4750e9c1a6a before 87bc611c6c98a41c00feb7b06b0c297dd141a2ae; from 5d990b627537e59a3a2f039ff588a4750e9c1a6a before 607432b2618b61df81134be0ef2562b8300c1216 | CNA record |
References
- https://git.kernel.org/stable/c/579eb867d3da63f3b5e32f235925e1daa7ec70d0
- https://git.kernel.org/stable/c/aaeb81241e802c86be69394f72d49fde3f861fbb
- https://git.kernel.org/stable/c/45705a6bfdb283f7b3b509010fd617b72f942537
- https://git.kernel.org/stable/c/87bc611c6c98a41c00feb7b06b0c297dd141a2ae
- https://git.kernel.org/stable/c/607432b2618b61df81134be0ef2562b8300c1216
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.