# CVE-2026-90240

Linux VT-d IOMMU bug can let DMA reference freed memory, enabling potential kernel RCE.

- Page: https://www.vulneraibility.com/cve/CVE-2026-90240
- CVSS: 8.8
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.16% (percentile 5.6)
- Published: 2026-09-17

## Affected versions

- Linux: affected >= f90584f4beb84211c4d21b319cc13f391fe9f3c2 and < a803141597d61dc0511f7cd849625e17d042ca8a; >= f90584f4beb84211c4d21b319cc13f391fe9f3c2 and < 5baddf100b3be730912485648cbaae5e3a251923; >= f90584f4beb84211c4d21b319cc13f391fe9f3c2 and < c54e4ae971b98e8d650400137d332cee56c03f55; 6.11; fixed in < 6.11, >= 6.18.52 and <= 6.18.*, >= 7.2.6 and <= 7.2.*, >= 7.3-rc1 and <= *

A version outside these ranges is not a statement that it is unaffected.

## Impact

Stale IOMMU context entries can cause IOMMU to walk freed memory, enabling DMA-induced memory corruption and possible host/kernel RCE or guest escape.

## Action

Patch when possible

## Recommendation

Apply the upstream/stable Linux kernel update containing the VT-d fix immediately.

## References

- [other] https://git.kernel.org/stable/c/3eb6ad14ef359e426cff14942e220de101cdbe84
- [other] https://git.kernel.org/stable/c/a803141597d61dc0511f7cd849625e17d042ca8a
- [other] https://git.kernel.org/stable/c/5baddf100b3be730912485648cbaae5e3a251923
- [other] https://git.kernel.org/stable/c/c54e4ae971b98e8d650400137d332cee56c03f55

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.