In the Linux kernel, the following vulnerability has been resolved:
iommu/vt-d: Restore context entry setup order for aliased devices
Commit 2031c469f816 ("iommu/vt-d: Add support for static identity domain") changed the context entry setup during domain attachment from a set-and-check policy to a clear-and-reset approach. This inadvertently introduced a regression affecting PCI aliased devices behind PCIe-to-PCI bridges.
Specifically, keyboard and touchpad stopped working on several Apple Macbooks with below messages:
kernel: platform pxa2xx-spi.3: Adding to iommu group 20 kernel: input: Apple SPI Keyboard as /devices/pci0000:00/0000:00:1e.3/pxa2xx-spi.3/spi_master/spi2/spi-APP000D:00/input/input0 kernel: DMAR: DRHD: handling fault status reg 3 kernel: DMAR: [DMA Read NO_PASID] Request device [00:1e.3] fault addr 0xffffa000 [fault reason 0x06] PTE Read access is not set kernel: DMAR: DRHD: handling fault status reg 3 kernel: DMAR: [DMA Read NO_PASID] Request device [00:1e.3] fault addr 0xffffa000 [fault reason 0x06] PTE Read access is not set kernel: applespi spi-APP000D:00: Error writing to device: 01 0e 00 00 kernel: DMAR: DRHD: handling fault status reg 3 kernel: DMAR: [DMA Read NO_PASID] Request device [00:1e.3] fault addr 0xffffa000 [fault reason 0x06] PTE Read access is not set kernel: DMAR: DRHD: handling fault status reg 3 kernel: applespi spi-APP000D:00: Error writing to device: 01 0e 00 00
Fix this by restoring the previous context setup order.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade perf6.12-debuginfoUpgrade kernel-develUpgrade python3-perf6.12Upgrade kernel-libbpf-develUpgrade kernel-tools-develUpgrade python3-perf6.12-debuginfoUpgrade kernel-headersUpgrade kernel6.12-debuginfoUpgrade kernel-livepatch-6.12.35-55.103Upgrade kernel-modules-extra-commonUpgrade kernel6.12Upgrade kernel-libbpf-staticUpgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel-toolsUpgrade bpftool-debuginfoUpgrade kernel-tools-debuginfoUpgrade perf6.12Upgrade bpftoolUpgrade kernel6.12-modules-extraUpgrade kernel6.12-debuginfo-common-aarch64Upgrade kernel-libbpf-debuginfoUpgrade kernel-libbpf | Sep 9, 2025 | Jul 4, 2025 |
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jul 4, 2025 |
| Suse | — | Upgrade cluster-md-kmp-64kbUpgrade dtb-caviumUpgrade kernel-default-baseUpgrade kernel-default-livepatchUpgrade kernel-preempt-develUpgrade dtb-amdUpgrade kernel-rt-livepatchUpgrade cluster-md-kmp-rtUpgrade kernel-develUpgrade ocfs2-kmp-defaultUpgrade kernel-docsUpgrade kernel-defaultUpgrade dtb-alteraUpgrade kernel-64kb-extraUpgrade dtb-allwinnerUpgrade kernel-64kb-optionalUpgrade kernel-rt-develUpgrade kernel-azureUpgrade dlm-kmp-defaultUpgrade dtb-hisiliconUpgrade gfs2-kmp-defaultUpgrade kernel-source-vanillaUpgrade dtb-xilinxUpgrade dtb-appleUpgrade dtb-mediatekUpgrade reiserfs-kmp-defaultUpgrade kernel-rt-extraUpgrade dtb-nvidiaUpgrade kselftests-kmp-rtUpgrade dtb-socionextUpgrade dtb-renesasUpgrade kernel-default-optionalUpgrade kernel-obs-buildUpgrade dtb-sprdUpgrade kernel-64kb-develUpgrade dlm-kmp-rtUpgrade kernel-default-livepatch-develUpgrade ocfs2-kmp-rtUpgrade dtb-lgUpgrade kernel-syms-azureUpgrade kernel-preemptUpgrade dtb-apmUpgrade cluster-md-kmp-defaultUpgrade kernel-rtUpgrade kernel-rt-vdsoUpgrade kernel-rt-livepatch-develUpgrade dtb-broadcomUpgrade dtb-rockchipUpgrade kselftests-kmp-defaultUpgrade kernel-zfcpdumpUpgrade dtb-exynosUpgrade ocfs2-kmp-64kbUpgrade kernel-kvmsmall-develUpgrade kselftests-kmp-64kbUpgrade kernel-macrosUpgrade kernel-kvmsmall-vdsoUpgrade kernel-devel-azureUpgrade kernel-docs-htmlUpgrade kernel-default-extraUpgrade kernel-64kbUpgrade dtb-qcomUpgrade dlm-kmp-64kbUpgrade dtb-marvellUpgrade dtb-amazonUpgrade dtb-freescaleUpgrade kernel-default-develUpgrade kernel-source-azureUpgrade kernel-azure-develUpgrade kernel-symsUpgrade gfs2-kmp-64kbUpgrade kernel-kvmsmallUpgrade kernel-default-vdsoUpgrade gfs2-kmp-rtUpgrade kernel-sourceUpgrade dtb-amlogicUpgrade kernel-obs-qaUpgrade kernel-rt-optionalUpgrade dtb-arm | Dec 5, 2025 | Oct 15, 2025 |
| Ubuntu | — | Upgrade linux-image-realtime-6.14Upgrade linux-image-awsUpgrade linux-image-azure-6.14Upgrade linux-image-gcp-64k-6.14Upgrade linux-image-6.14.0-1006-realtimeUpgrade linux-image-oracle-6.14Upgrade linux-image-oem-6.14Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-realtimeUpgrade linux-image-generic-64k-6.14Upgrade linux-image-oracle-64k-6.14Upgrade linux-image-oracleUpgrade linux-image-6.14.0-1009-oracle-64kUpgrade linux-image-6.14.0-1010-azureUpgrade linux-image-6.14.0-1011-gcp-64kUpgrade linux-image-azureUpgrade linux-image-6.14.0-1009-awsUpgrade linux-image-virtual-6.14Upgrade linux-image-raspiUpgrade linux-image-aws-64k-6.14Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-realtime-hwe-24.04Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-genericUpgrade linux-image-6.14.0-1009-oracleUpgrade linux-image-generic-64kUpgrade linux-image-gcp-6.14Upgrade linux-image-6.14.0-24-generic-64kUpgrade linux-image-generic-6.14Upgrade linux-image-oem-24.04aUpgrade linux-image-virtualUpgrade linux-image-6.14.0-1009-aws-64kUpgrade linux-image-aws-64kUpgrade linux-image-6.14.0-1009-raspiUpgrade linux-image-aws-6.14Upgrade linux-image-oem-24.04cUpgrade linux-image-6.14.0-1007-oemUpgrade linux-image-6.14.0-1011-gcpUpgrade linux-image-gcp-64kUpgrade linux-image-6.14.0-24-genericUpgrade linux-image-raspi-6.14Upgrade linux-image-oracle-64kUpgrade linux-image-gcpUpgrade linux-image-oem-24.04 | Jul 9, 2025 | Jul 4, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub