Bug 2467088 (CVE-2026-43220)

Summary:	CVE-2026-43220 kernel: iommu/amd: serialize sequence allocation under concurrent TLB invalidations
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	unspecified	CC:	rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Linux kernel, specifically within the `iommu/amd` component responsible for managing memory access. This vulnerability arises from an issue in how commands are processed during concurrent memory invalidations, causing them to be queued out of sequence. This can lead to system instability and timeouts, potentially allowing an attacker to trigger a Denial of Service (DoS) condition, rendering the system unavailable.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-05-06 13:03:36 UTC

In the Linux kernel, the following vulnerability has been resolved:

iommu/amd: serialize sequence allocation under concurrent TLB invalidations

With concurrent TLB invalidations, completion wait randomly gets timed out
because cmd_sem_val was incremented outside the IOMMU spinlock, allowing
CMD_COMPL_WAIT commands to be queued out of sequence and breaking the
ordering assumption in wait_on_sem().
Move the cmd_sem_val increment under iommu->lock so completion sequence
allocation is serialized with command queuing.
And remove the unnecessary return.

Comment 1 Keith Grant 2026-05-06 22:02:30 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026050652-CVE-2026-43220-cf2b@gregkh/T