CVE-2026-89448 iommu/vt-d: Force requesting ACS when tboot is enabled
Attackers may bypass IOMMU isolation when tboot is enabled if ACS is disabled, requiring a kernel patch to enforce correct configuration.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89448?
CVE-2026-89448 is a critical vulnerability in Linux, published on 11 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
iommu/vt-d: Force requesting ACS when tboot is enabled
Currently the conditions of requesting ACS in detect_intel_iommu() don't include tboot, leading to a possible misconfiguration with ACS disabled (e.g. due to user opts) while iommu is later forced on by tboot_force_iommu().
Fix it by checking tboot in detect_intel_iommu().
Which versions are affected by CVE-2026-89448?
How do I fix CVE-2026-89448?
Apply the vendor's patch.
Is CVE-2026-89448 being exploited?
There is no known exploitation of CVE-2026-89448 in the wild and no public exploit code.
Sources
Also known as AZL-100874, BELL-CVE-2026-89448, DEBIAN-CVE-2026-89448, GHSA-mhhr-wjj6-vjmr, UBUNTU-CVE-2026-89448.