iommu/vt-d PASID Race

Vulnerability analysis

The vulnerability is a race condition in Intel VT-d IOMMU PASID table management. When allocating a new PASID table, the kernel writes the table address to the PASID directory entry before flushing the CPU cache containing the zero-initialized table contents. On non-coherent IOMMU hardware, this creates a window where the IOMMU can access the table while RAM still contains stale data instead of the expected zeros. This can cause unrecoverable faults and may allow the device to perform unintended DMA reads or writes based on stale page-table-like data. The fix reorders operations to flush the cache before making the table visible to hardware, ensuring coherency between CPU cache and main memory.