CVE-2026-43220 iommu/amd: serialize sequence allocation under concurrent TLB invalidations
Concurrent TLB invalidations in the Linux kernel IOMMU driver can cause completion wait timeouts due to a race condition, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-43220?
CVE-2026-43220 is a medium-severity vulnerability in Linux kernel, published on 6 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
iommu/amd: serialize sequence allocation under concurrent TLB invalidations
With concurrent TLB invalidations, completion wait randomly gets timed out because cmd_sem_val was incremented outside the IOMMU spinlock, allowing CMD_COMPL_WAIT commands to be queued out of sequence and breaking the ordering assumption in wait_on_sem(). Move the cmd_sem_val increment under iommu->lock so completion sequence allocation is serialized with command queuing. And remove the unnecessary return.
Which versions are affected by CVE-2026-43220?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-43220?
Apply the vendor's patch.
Is CVE-2026-43220 being exploited?
There is no known exploitation of CVE-2026-43220 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-86648, BELL-CVE-2026-43220, DEBIAN-CVE-2026-43220, GHSA-v974-2cjf-22q5, ROOT-OS-UBUNTU-2204-CVE-2026-43220, ROOT-OS-UBUNTU-2404-CVE-2026-43220 and 1 more.