GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-43161 (GCVE-0-2026-43161)

Vulnerability from cvelistv5 – Published: 2026-05-06 11:27 – Updated: 2026-05-23 16:06
VLAI
Title
iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode
Summary
In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode PCIe endpoints with ATS enabled and passed through to userspace (e.g., QEMU, DPDK) can hard-lock the host when their link drops, either by surprise removal or by a link fault. Commit 4fc82cd907ac ("iommu/vt-d: Don't issue ATS Invalidation request when device is disconnected") adds pci_dev_is_disconnected() to devtlb_invalidation_with_pasid() so ATS invalidation is skipped only when the device is being safely removed, but it applies only when Intel IOMMU scalable mode is enabled. With scalable mode disabled or unsupported, a system hard-lock occurs when a PCIe endpoint's link drops because the Intel IOMMU waits indefinitely for an ATS invalidation that cannot complete. Call Trace: qi_submit_sync qi_flush_dev_iotlb __context_flush_dev_iotlb.part.0 domain_context_clear_one_cb pci_for_each_dma_alias device_block_translation blocking_domain_attach_dev iommu_deinit_device __iommu_group_remove_device iommu_release_device iommu_bus_notifier blocking_notifier_call_chain bus_notify device_del pci_remove_bus_device pci_stop_and_remove_bus_device pciehp_unconfigure_device pciehp_disable_slot pciehp_handle_presence_or_link_change pciehp_ist Commit 81e921fd3216 ("iommu/vt-d: Fix NULL domain on device release") adds intel_pasid_teardown_sm_context() to intel_iommu_release_device(), which calls qi_flush_dev_iotlb() and can also hard-lock the system when a PCIe endpoint's link drops. Call Trace: qi_submit_sync qi_flush_dev_iotlb __context_flush_dev_iotlb.part.0 intel_context_flush_no_pasid device_pasid_table_teardown pci_pasid_table_teardown pci_for_each_dma_alias intel_pasid_teardown_sm_context intel_iommu_release_device iommu_deinit_device __iommu_group_remove_device iommu_release_device iommu_bus_notifier blocking_notifier_call_chain bus_notify device_del pci_remove_bus_device pci_stop_and_remove_bus_device pciehp_unconfigure_device pciehp_disable_slot pciehp_handle_presence_or_link_change pciehp_ist Sometimes the endpoint loses connection without a link-down event (e.g., due to a link fault); killing the process (virsh destroy) then hard-locks the host. Call Trace: qi_submit_sync qi_flush_dev_iotlb __context_flush_dev_iotlb.part.0 domain_context_clear_one_cb pci_for_each_dma_alias device_block_translation blocking_domain_attach_dev __iommu_attach_device __iommu_device_set_domain __iommu_group_set_domain_internal iommu_detach_group vfio_iommu_type1_detach_group vfio_group_detach_container vfio_group_fops_release __fput pci_dev_is_disconnected() only covers safe-removal paths; pci_device_is_present() tests accessibility by reading vendor/device IDs and internally calls pci_dev_is_disconnected(). On a ConnectX-5 (8 GT/s, x2) this costs ~70 µs. Since __context_flush_dev_iotlb() is only called on {attach,release}_dev paths (not hot), add pci_device_is_present() there to skip inaccessible devices and avoid the hard-lock.
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 37764b952e1b39053defc7ebe5dcd8c4e3e78de9 , < 48b3f08e68b29a79527869cdde7298ca2a9b9646 (git)
Affected: 37764b952e1b39053defc7ebe5dcd8c4e3e78de9 , < e70d5feb10c5ba2bbf7ca400b8f39a2f82d653e8 (git)
Affected: 37764b952e1b39053defc7ebe5dcd8c4e3e78de9 , < bc0490ad9edf5c6f98e39fbbee2877b85261a5ae (git)
Affected: 37764b952e1b39053defc7ebe5dcd8c4e3e78de9 , < 42662d19839f34735b718129ea200e3734b07e50 (git)
Affected: 99301a53a1378f8863ac7850b9589f997bb0e125 (git)
Affected: 948ec6d003280d49aca49b366aa5cb140f87434d (git)
Affected: 5.12.19 , < 5.13 (semver)
Affected: 5.13.4 , < 5.14 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.14
Unaffected: 0 , < 5.14 (semver)
Unaffected: 6.12.77 , ≤ 6.12.* (semver)
Unaffected: 6.18.17 , ≤ 6.18.* (semver)
Unaffected: 6.19.6 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/intel/pasid.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "48b3f08e68b29a79527869cdde7298ca2a9b9646",
              "status": "affected",
              "version": "37764b952e1b39053defc7ebe5dcd8c4e3e78de9",
              "versionType": "git"
            },
            {
              "lessThan": "e70d5feb10c5ba2bbf7ca400b8f39a2f82d653e8",
              "status": "affected",
              "version": "37764b952e1b39053defc7ebe5dcd8c4e3e78de9",
              "versionType": "git"
            },
            {
              "lessThan": "bc0490ad9edf5c6f98e39fbbee2877b85261a5ae",
              "status": "affected",
              "version": "37764b952e1b39053defc7ebe5dcd8c4e3e78de9",
              "versionType": "git"
            },
            {
              "lessThan": "42662d19839f34735b718129ea200e3734b07e50",
              "status": "affected",
              "version": "37764b952e1b39053defc7ebe5dcd8c4e3e78de9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "99301a53a1378f8863ac7850b9589f997bb0e125",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "948ec6d003280d49aca49b366aa5cb140f87434d",
              "versionType": "git"
            },
            {
              "lessThan": "5.13",
              "status": "affected",
              "version": "5.12.19",
              "versionType": "semver"
            },
            {
              "lessThan": "5.14",
              "status": "affected",
              "version": "5.13.4",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/intel/pasid.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.77",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.17",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.77",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.17",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.6",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.12.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.13.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode\n\nPCIe endpoints with ATS enabled and passed through to userspace\n(e.g., QEMU, DPDK) can hard-lock the host when their link drops,\neither by surprise removal or by a link fault.\n\nCommit 4fc82cd907ac (\"iommu/vt-d: Don\u0027t issue ATS Invalidation\nrequest when device is disconnected\") adds pci_dev_is_disconnected()\nto devtlb_invalidation_with_pasid() so ATS invalidation is skipped\nonly when the device is being safely removed, but it applies only\nwhen Intel IOMMU scalable mode is enabled.\n\nWith scalable mode disabled or unsupported, a system hard-lock\noccurs when a PCIe endpoint\u0027s link drops because the Intel IOMMU\nwaits indefinitely for an ATS invalidation that cannot complete.\n\nCall Trace:\n qi_submit_sync\n qi_flush_dev_iotlb\n __context_flush_dev_iotlb.part.0\n domain_context_clear_one_cb\n pci_for_each_dma_alias\n device_block_translation\n blocking_domain_attach_dev\n iommu_deinit_device\n __iommu_group_remove_device\n iommu_release_device\n iommu_bus_notifier\n blocking_notifier_call_chain\n bus_notify\n device_del\n pci_remove_bus_device\n pci_stop_and_remove_bus_device\n pciehp_unconfigure_device\n pciehp_disable_slot\n pciehp_handle_presence_or_link_change\n pciehp_ist\n\nCommit 81e921fd3216 (\"iommu/vt-d: Fix NULL domain on device release\")\nadds intel_pasid_teardown_sm_context() to intel_iommu_release_device(),\nwhich calls qi_flush_dev_iotlb() and can also hard-lock the system\nwhen a PCIe endpoint\u0027s link drops.\n\nCall Trace:\n qi_submit_sync\n qi_flush_dev_iotlb\n __context_flush_dev_iotlb.part.0\n intel_context_flush_no_pasid\n device_pasid_table_teardown\n pci_pasid_table_teardown\n pci_for_each_dma_alias\n intel_pasid_teardown_sm_context\n intel_iommu_release_device\n iommu_deinit_device\n __iommu_group_remove_device\n iommu_release_device\n iommu_bus_notifier\n blocking_notifier_call_chain\n bus_notify\n device_del\n pci_remove_bus_device\n pci_stop_and_remove_bus_device\n pciehp_unconfigure_device\n pciehp_disable_slot\n pciehp_handle_presence_or_link_change\n pciehp_ist\n\nSometimes the endpoint loses connection without a link-down event\n(e.g., due to a link fault); killing the process (virsh destroy)\nthen hard-locks the host.\n\nCall Trace:\n qi_submit_sync\n qi_flush_dev_iotlb\n __context_flush_dev_iotlb.part.0\n domain_context_clear_one_cb\n pci_for_each_dma_alias\n device_block_translation\n blocking_domain_attach_dev\n __iommu_attach_device\n __iommu_device_set_domain\n __iommu_group_set_domain_internal\n iommu_detach_group\n vfio_iommu_type1_detach_group\n vfio_group_detach_container\n vfio_group_fops_release\n __fput\n\npci_dev_is_disconnected() only covers safe-removal paths;\npci_device_is_present() tests accessibility by reading\nvendor/device IDs and internally calls pci_dev_is_disconnected().\nOn a ConnectX-5 (8 GT/s, x2) this costs ~70 \u00b5s.\n\nSince __context_flush_dev_iotlb() is only called on\n{attach,release}_dev paths (not hot), add pci_device_is_present()\nthere to skip inaccessible devices and avoid the hard-lock."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T16:06:27.637Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/48b3f08e68b29a79527869cdde7298ca2a9b9646"
        },
        {
          "url": "https://git.kernel.org/stable/c/e70d5feb10c5ba2bbf7ca400b8f39a2f82d653e8"
        },
        {
          "url": "https://git.kernel.org/stable/c/bc0490ad9edf5c6f98e39fbbee2877b85261a5ae"
        },
        {
          "url": "https://git.kernel.org/stable/c/42662d19839f34735b718129ea200e3734b07e50"
        }
      ],
      "title": "iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43161",
    "datePublished": "2026-05-06T11:27:39.881Z",
    "dateReserved": "2026-05-01T14:12:55.990Z",
    "dateUpdated": "2026-05-23T16:06:27.637Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-43161",
      "date": "2026-09-16",
      "epss": "0.00122",
      "percentile": "0.02281"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-10T14:44:02.000Z",
      "cve": "CVE-2026-43161",
      "id": "msrc_CVE-2026-43161",
      "initial_release_date": "2026-05-07T01:05:01.000Z",
      "product_status:known_affected": "8",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-43161.json",
      "version": "11"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-43161\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-06T12:16:34.137\",\"lastModified\":\"2026-06-17T10:49:02.943\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\niommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode\\n\\nPCIe endpoints with ATS enabled and passed through to userspace\\n(e.g., QEMU, DPDK) can hard-lock the host when their link drops,\\neither by surprise removal or by a link fault.\\n\\nCommit 4fc82cd907ac (\\\"iommu/vt-d: Don\u0027t issue ATS Invalidation\\nrequest when device is disconnected\\\") adds pci_dev_is_disconnected()\\nto devtlb_invalidation_with_pasid() so ATS invalidation is skipped\\nonly when the device is being safely removed, but it applies only\\nwhen Intel IOMMU scalable mode is enabled.\\n\\nWith scalable mode disabled or unsupported, a system hard-lock\\noccurs when a PCIe endpoint\u0027s link drops because the Intel IOMMU\\nwaits indefinitely for an ATS invalidation that cannot complete.\\n\\nCall Trace:\\n qi_submit_sync\\n qi_flush_dev_iotlb\\n __context_flush_dev_iotlb.part.0\\n domain_context_clear_one_cb\\n pci_for_each_dma_alias\\n device_block_translation\\n blocking_domain_attach_dev\\n iommu_deinit_device\\n __iommu_group_remove_device\\n iommu_release_device\\n iommu_bus_notifier\\n blocking_notifier_call_chain\\n bus_notify\\n device_del\\n pci_remove_bus_device\\n pci_stop_and_remove_bus_device\\n pciehp_unconfigure_device\\n pciehp_disable_slot\\n pciehp_handle_presence_or_link_change\\n pciehp_ist\\n\\nCommit 81e921fd3216 (\\\"iommu/vt-d: Fix NULL domain on device release\\\")\\nadds intel_pasid_teardown_sm_context() to intel_iommu_release_device(),\\nwhich calls qi_flush_dev_iotlb() and can also hard-lock the system\\nwhen a PCIe endpoint\u0027s link drops.\\n\\nCall Trace:\\n qi_submit_sync\\n qi_flush_dev_iotlb\\n __context_flush_dev_iotlb.part.0\\n intel_context_flush_no_pasid\\n device_pasid_table_teardown\\n pci_pasid_table_teardown\\n pci_for_each_dma_alias\\n intel_pasid_teardown_sm_context\\n intel_iommu_release_device\\n iommu_deinit_device\\n __iommu_group_remove_device\\n iommu_release_device\\n iommu_bus_notifier\\n blocking_notifier_call_chain\\n bus_notify\\n device_del\\n pci_remove_bus_device\\n pci_stop_and_remove_bus_device\\n pciehp_unconfigure_device\\n pciehp_disable_slot\\n pciehp_handle_presence_or_link_change\\n pciehp_ist\\n\\nSometimes the endpoint loses connection without a link-down event\\n(e.g., due to a link fault); killing the process (virsh destroy)\\nthen hard-locks the host.\\n\\nCall Trace:\\n qi_submit_sync\\n qi_flush_dev_iotlb\\n __context_flush_dev_iotlb.part.0\\n domain_context_clear_one_cb\\n pci_for_each_dma_alias\\n device_block_translation\\n blocking_domain_attach_dev\\n __iommu_attach_device\\n __iommu_device_set_domain\\n __iommu_group_set_domain_internal\\n iommu_detach_group\\n vfio_iommu_type1_detach_group\\n vfio_group_detach_container\\n vfio_group_fops_release\\n __fput\\n\\npci_dev_is_disconnected() only covers safe-removal paths;\\npci_device_is_present() tests accessibility by reading\\nvendor/device IDs and internally calls pci_dev_is_disconnected().\\nOn a ConnectX-5 (8 GT/s, x2) this costs ~70 \u00b5s.\\n\\nSince __context_flush_dev_iotlb() is only called on\\n{attach,release}_dev paths (not hot), add pci_device_is_present()\\nthere to skip inaccessible devices and avoid the hard-lock.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/iommu/intel/pasid.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"37764b952e1b39053defc7ebe5dcd8c4e3e78de9\",\"lessThan\":\"48b3f08e68b29a79527869cdde7298ca2a9b9646\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"37764b952e1b39053defc7ebe5dcd8c4e3e78de9\",\"lessThan\":\"e70d5feb10c5ba2bbf7ca400b8f39a2f82d653e8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"37764b952e1b39053defc7ebe5dcd8c4e3e78de9\",\"lessThan\":\"bc0490ad9edf5c6f98e39fbbee2877b85261a5ae\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"37764b952e1b39053defc7ebe5dcd8c4e3e78de9\",\"lessThan\":\"42662d19839f34735b718129ea200e3734b07e50\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"99301a53a1378f8863ac7850b9589f997bb0e125\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"948ec6d003280d49aca49b366aa5cb140f87434d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.12.19\",\"lessThan\":\"5.13\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.13.4\",\"lessThan\":\"5.14\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/iommu/intel/pasid.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.77\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.17\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19.6\",\"lessThanOrEqual\":\"6.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.12.19\",\"versionEndExcluding\":\"5.13\",\"matchCriteriaId\":\"8C2A0F7A-34D9-4DE2-893B-3C8AB10FFB6A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.13.4\",\"versionEndExcluding\":\"5.14\",\"matchCriteriaId\":\"B6D2AA29-7EC0-4F37-94E7-CF564CCEF770\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.14.1\",\"versionEndExcluding\":\"6.12.77\",\"matchCriteriaId\":\"44437941-390C-4B72-BE02-59B97C0C1F02\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.17\",\"matchCriteriaId\":\"A5E006E4-59C7-43C1-9231-62A72219F2BA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.6\",\"matchCriteriaId\":\"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.14:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"6A05198E-F8FA-4517-8D0E-8C95066AED38\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.14:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"23B9E5C6-FAB5-4A02-9E39-27C8787B0991\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.14:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"D185CF67-7E4A-4154-93DB-CE379C67DB56\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.14:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"D1DA0AF6-02F4-47C7-A318-8C006ED0C665\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.14:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"49DD30B1-8C99-4C38-A66B-CAB3827BEE8A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.14:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"15013998-4AF0-4CDC-AB13-829ECD8A8E66\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.14:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"376A25CF-C05B-48F1-99B1-8FB0314A8E06\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/42662d19839f34735b718129ea200e3734b07e50\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/48b3f08e68b29a79527869cdde7298ca2a9b9646\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bc0490ad9edf5c6f98e39fbbee2877b85261a5ae\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e70d5feb10c5ba2bbf7ca400b8f39a2f82d653e8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-28T07:35:42+00:00",
      "cve": "CVE-2026-43161",
      "id": "CVE-2026-43161",
      "initial_release_date": "2026-05-06T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43161.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-05-08T02:20:41Z",
      "cve": "CVE-2026-43161",
      "id": "CVE-2026-43161",
      "initial_release_date": "2026-05-08T02:20:41Z",
      "product_status:known_affected": "187",
      "product_status:known_not_affected": "39",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-43161",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-43161.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.