Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-64591— iommu/vt-d: Avoid WARNING in sva unbind path

AI Predicted 5.5 Difficulty: Easy EPSS 0.16% · P6

Affected Version Matrix 11

VendorProductVersion RangeStatus
LinuxLinuxee312bb1052e45cbccaf6abac1012db9ca43150a< bb354384f40bb087e7c44f0f0743a23fc945f91daffected
39c20c4e83b9f78988541d829aa34668904e54a0< 477f8dec3b5ae54e8ef3c33bdd2257e47896512eaffected
39c20c4e83b9f78988541d829aa34668904e54a0< 534b5f98ab7319d8004bbc7dab6481462243e883affected
46461dabb95239aa05e31e247cd21151b8406642affected
6.18.20< 6.18.39affected
6.19.10< 6.20affected
7.0affected
< 7.0unaffected
… +3 more rows
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2026-64591

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
iommu/vt-d: Avoid WARNING in sva unbind path
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Avoid WARNING in sva unbind path The Intel IOMMU driver allows SVA on devices even if they do not support PCI/PRI. Commit 39c20c4e83b9 ("iommu/vt-d: Only handle IOPF for SVA when PRI is supported") modified the SVA bind path to allow this configuration by skipping IOPF enablement when PRI is missing. However, it failed to update the unbind path. This creates an imbalance: the unbind path attempts to disable IOPF for a device that never had it enabled, triggering a WARNING in intel_iommu_disable_iopf(): WARNING: drivers/iommu/intel/iommu.c:3475 at intel_iommu_disable_iopf+0x4f/0x90d Call Trace: <TASK> blocking_domain_set_dev_pasid+0x50/0x70 iommu_detach_device_pasid+0x89/0xc0 iommu_sva_unbind_device+0x73/0x150 xe_vm_close_and_put+0x4d2/0x1200 [xe] Fix this by bypassing IOPF operations for SVA domains on non-PRI hardware in both the bind and unbind paths.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel 7.0版本存在安全漏洞，该漏洞源于SVA unbind路径未同步更新，对不支持PCI/PRI的设备尝试禁用从未启用过的IOPF，导致内核触发警告。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
LinuxLinux ee312bb1052e45cbccaf6abac1012db9ca43150a ~ bb354384f40bb087e7c44f0f0743a23fc945f91d -
LinuxLinux 7.0 -

II. Public POCs for CVE-2026-64591

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-64591

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-64591 (3)

Same Patch Batch · Linux · 2026-08-06 · 22 CVEs total

CVE-2026-645979.8 CRITICALsmb: client: fix double-free in SMB2_close() replay
CVE-2026-645868.8 HIGHwifi: brcmfmac: drain bus_reset work on device removal
CVE-2026-645988.8 HIGHsmb/client: Fix error code in smb2_aead_req_alloc()
CVE-2026-645847.8 HIGHusb: gadget: f_midi: cancel pending IN work before freeing the midi object
CVE-2026-645857.8 HIGHcan: esd_usb: kill anchored URBs before freeing netdevs
CVE-2026-645887.8 HIGHfuse-uring: fix data races on ring->ready
CVE-2026-645837.8 HIGHusb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown
CVE-2026-646017.8 HIGHALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts anchor list on ea
CVE-2026-645997.8 HIGHcrypto: amlogic - avoid double cleanup in meson_crypto_probe()
CVE-2026-645877.0 HIGHnet: ethernet: arc: emac: quiesce interrupts before requesting IRQ
CVE-2026-68480x86/bugs: Make Safe-RET robust against interrupt injection
CVE-2026-64604KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode
CVE-2026-64603platform/x86: intel-hid: Protect ACPI notify handler against recursion
CVE-2026-64602iio: adc: spear: Initialize completion before requesting IRQ
CVE-2026-64596libfs: set SB_I_NOEXEC and SB_I_NODEV by default in init_pseudo()
CVE-2026-64595HID: hid-lenovo-go: cancel cfg_setup work in hid_go_cfg_remove()
CVE-2026-64593btrfs: do not trim a device which is not writeable
CVE-2026-64594usb: gadget: f_fs: initialize reset_work at allocation time
CVE-2026-64592riscv: mm: Unconditionally sfence.vma for spurious fault
CVE-2026-64590dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning

Showing top 20 of 22 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-64591

No comments yet

Leave a comment