CVE-2026-43161 [Medium] | Security Vulnerability in Linux Kernel

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode PCIe endpoints with ATS enabled and passed through to userspace (e.g., QEMU, DPDK) can hard-lock the host when their link drops, either by surprise removal or by a link fault. Commit 4fc82cd907ac ("iommu/vt-d: Don't issue ATS Invalidation request when device is disconnected") adds pci_dev_is_disconnected() to devtlb_invalidation_with_pasid() so ATS invalidation is skipped only when the device is being safely removed, but it applies only when Intel IOMMU scalable mode is enabled. With scalable mode disabled or unsupported, a system hard-lock occurs when a PCIe endpoint's link drops because the Intel IOMMU waits indefinitely for an ATS invalidation that cannot complete. Call Trace: qi_submit_sync qi_flush_dev_iotlb __context_flush_dev_iotlb.part.0 domain_context_clear_one_cb pci_for_each_dma_alias device_block_translation blocking_domain_attach_dev iommu_deinit_device __iommu_group_remove_device iommu_release_device iommu_bus_notifier blocking_notifier_call_chain bus_notify device_del pci_remove_bus_device pci_stop_and_remove_bus_device pciehp_unconfigure_device pciehp_disable_slot pciehp_handle_presence_or_link_change pciehp_ist Commit 81e921fd3216 ("iommu/vt-d: Fix NULL domain on device release") adds intel_pasid_teardown_sm_context() to intel_iommu_release_device(), which calls qi_flush_dev_iotlb() and can also hard-lock the system when a PCIe endpoint's link drops. Call Trace: qi_submit_sync qi_flush_dev_iotlb __context_flush_dev_iotlb.part.0 intel_context_flush_no_pasid device_pasid_table_teardown pci_pasid_table_teardown pci_for_each_dma_alias intel_pasid_teardown_sm_context intel_iommu_release_device iommu_deinit_device __iommu_group_remove_device iommu_release_device iommu_bus_notifier blocking_notifier_call_chain bus_notify device_del pci_remove_bus_device pci_stop_and_remove_bus_device pciehp_unconfigure_device pciehp_disable_slot pciehp_handle_presence_or_link_change pciehp_ist Sometimes the endpoint loses connection without a link-down event (e.g., due to a link fault); killing the process (virsh destroy) then hard-locks the host. Call Trace: qi_submit_sync qi_flush_dev_iotlb __context_flush_dev_iotlb.part.0 domain_context_clear_one_cb pci_for_each_dma_alias device_block_translation blocking_domain_attach_dev __iommu_attach_device __iommu_device_set_domain __iommu_group_set_domain_internal iommu_detach_group vfio_iommu_type1_detach_group vfio_group_detach_container vfio_group_fops_release __fput pci_dev_is_disconnected() only covers safe-removal paths; pci_device_is_present() tests accessibility by reading vendor/device IDs and internally calls pci_dev_is_disconnected(). On a ConnectX-5 (8 GT/s, x2) this costs ~70 µs. Since __context_flush_dev_iotlb() is only called on {attach,release}_dev paths (not hot), add pci_device_is_present() there to skip inaccessible devices and avoid the hard-lock.

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-05-07	—	0.02%	—

Date

Old EPSS score

New EPSS score

Delta (New - Old)

2026-05-07

—

0.02%

—

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
5.5	3.1	MEDIUM	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H` Click to expand Attack vector (AV:L) They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:L) A normal user session is enough; they don’t have to be admin. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:N) Doesn’t really leak secrets in a meaningful way. Integrity (I:N) Data isn’t meaningfully altered or forged. Availability (A:H) Could take the service down hard or make it unusable for people who depend on it.	1.8	3.6	[email protected]

Base score

Version

Severity

Vector

Exploitability

Impact

Score source

5.5

3.1

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Click to expand

Attack vector (AV:L): They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by.
Attack complexity (AC:L): Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:L): A normal user session is enough; they don’t have to be admin.
User interaction (UI:N): Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U): Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:N): Doesn’t really leak secrets in a meaningful way.
Integrity (I:N): Data isn’t meaningfully altered or forged.
Availability (A:H): Could take the service down hard or make it unusable for people who depend on it.

1.8

3.6

[email protected]

OS Trackers for CVE-2026-43161

vendor	priority	summary	link
`debian`	unimportant	CVE-2026-43161 unimportant priority: Debian including 1 source packages (linux), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 4, open 1.	https://security-tracker.debian.org/tracker/CVE-2026-43161
`redhat`	medium	—	https://access.redhat.com/security/cve/CVE-2026-43161
`suse`	medium	CVE-2026-43161 severity moderate: SUSE including 14 source package names (cluster-md-kmp-default, dlm-kmp-default, …), 39 product×package rows across 8 product lines (SUSE Linux Enterprise Live Patching 12 SP5, SUSE Linux Enterprise Micro 5.0, … (8 product lines)): Known Not Affected 39.	https://www.suse.com/security/cve/CVE-2026-43161/
`ubuntu`	medium	CVE-2026-43161 medium priority: Ubuntu including 161 source packages (linux, linux-allwinner-5.19, …), 1449 status rows across 9 suites (bionic, focal, jammy, noble, questing, resolute, trusty, upstream, xenial): DNE 1048, ignored 169, needed 89, released 83, not-affected 55, needs-triage 5.	https://ubuntu.com/security/CVE-2026-43161

Affected software / configurations for CVE-2026-43161

Vendor	Product	Version	Raw CPE
linux	linux_kernel	>= 5.12.19, < 5.13	cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	>= 5.13.4, < 5.14	cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	>= 5.14.1, < 6.12.77	cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	>= 6.13, < 6.18.17	cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	>= 6.19, < 6.19.6	cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	5.14	cpe:2.3:o:linux:linux_kernel:5.14:-::::::
linux	linux_kernel	5.14	cpe:2.3:o:linux:linux_kernel:5.14:rc2::::::
linux	linux_kernel	5.14	cpe:2.3:o:linux:linux_kernel:5.14:rc3::::::
linux	linux_kernel	5.14	cpe:2.3:o:linux:linux_kernel:5.14:rc4::::::
linux	linux_kernel	5.14	cpe:2.3:o:linux:linux_kernel:5.14:rc5::::::
linux	linux_kernel	5.14	cpe:2.3:o:linux:linux_kernel:5.14:rc6::::::
linux	linux_kernel	5.14	cpe:2.3:o:linux:linux_kernel:5.14:rc7::::::

References for CVE-2026-43161

URL	Tags
https://git.kernel.org/stable/c/42662d19839f34735b718129ea200e3734b07e50	Patch
https://git.kernel.org/stable/c/48b3f08e68b29a79527869cdde7298ca2a9b9646	Patch
https://git.kernel.org/stable/c/bc0490ad9edf5c6f98e39fbbee2877b85261a5ae	Patch
https://git.kernel.org/stable/c/e70d5feb10c5ba2bbf7ca400b8f39a2f82d653e8	Patch

URL

CVE-2026-43161 | iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode

Exploit prediction scoring system (EPSS) score for CVE-2026-43161

Common vulnerability scoring system (CVSS) metrics for CVE-2026-43161

Weakness enumeration for CVE-2026-43161

GitHub Security Advisory for CVE-2026-43161

OS Trackers for CVE-2026-43161

Affected software / configurations for CVE-2026-43161

References for CVE-2026-43161