In the Linux kernel, the following vulnerability has been resolved:
iommu/vt-d: Restore context entry setup order for aliased devices
Commit 2031c469f816 ("iommu/vt-d: Add support for static identity domain") changed the context entry setup during domain attachment from a set-and-check policy to a clear-and-reset approach. This inadvertently introduced a regression affecting PCI aliased devices behind PCIe-to-PCI bridges.
Specifically, keyboard and touchpad stopped working on several Apple Macbooks with below messages:
kernel: platform pxa2xx-spi.3: Adding to iommu group 20 kernel: input: Apple SPI Keyboard as /devices/pci0000:00/0000:00:1e.3/pxa2xx-spi.3/spi_master/spi2/spi-APP000D:00/input/input0 kernel: DMAR: DRHD: handling fault status reg 3 kernel: DMAR: [DMA Read NO_PASID] Request device [00:1e.3] fault addr 0xffffa000 [fault reason 0x06] PTE Read access is not set kernel: DMAR: DRHD: handling fault status reg 3 kernel: DMAR: [DMA Read NO_PASID] Request device [00:1e.3] fault addr 0xffffa000 [fault reason 0x06] PTE Read access is not set kernel: applespi spi-APP000D:00: Error writing to device: 01 0e 00 00 kernel: DMAR: DRHD: handling fault status reg 3 kernel: DMAR: [DMA Read NO_PASID] Request device [00:1e.3] fault addr 0xffffa000 [fault reason 0x06] PTE Read access is not set kernel: DMAR: DRHD: handling fault status reg 3 kernel: applespi spi-APP000D:00: Error writing to device: 01 0e 00 00
Fix this by restoring the previous context setup order.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade kernel6.12-modules-extraUpgrade kernel-libbpf-debuginfoUpgrade kernel-toolsUpgrade kernel-tools-debuginfoUpgrade bpftool-debuginfoUpgrade perf6.12Upgrade bpftoolUpgrade kernel6.12-debuginfo-common-aarch64Upgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel-libbpf-staticUpgrade kernel-libbpfUpgrade kernel6.12Upgrade perf6.12-debuginfoUpgrade kernel-modules-extra-commonUpgrade kernel-tools-develUpgrade python3-perf6.12-debuginfoUpgrade kernel-headersUpgrade kernel6.12-debuginfoUpgrade python3-perf6.12Upgrade kernel-develUpgrade kernel-livepatch-6.12.35-55.103Upgrade kernel-libbpf-devel | Sep 9, 2025 | Jul 4, 2025 |
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jul 4, 2025 |
| Suse | — | Upgrade dtb-caviumUpgrade kernel-obs-buildUpgrade kernel-preempt-develUpgrade kernel-defaultUpgrade kernel-default-optionalUpgrade dtb-hisiliconUpgrade kernel-64kb-optionalUpgrade ocfs2-kmp-defaultUpgrade kernel-rt-develUpgrade kselftests-kmp-rtUpgrade kernel-default-baseUpgrade kernel-default-livepatchUpgrade dtb-alteraUpgrade kernel-rt-extraUpgrade dlm-kmp-defaultUpgrade dtb-allwinnerUpgrade cluster-md-kmp-64kbUpgrade kernel-azureUpgrade kernel-develUpgrade dtb-xilinxUpgrade gfs2-kmp-defaultUpgrade dtb-renesasUpgrade kernel-source-vanillaUpgrade dtb-appleUpgrade kernel-default-livepatch-develUpgrade dtb-mediatekUpgrade dlm-kmp-rtUpgrade dtb-socionextUpgrade dtb-sprdUpgrade dtb-amdUpgrade dtb-nvidiaUpgrade cluster-md-kmp-rtUpgrade kernel-64kb-extraUpgrade kernel-docsUpgrade kernel-rt-livepatchUpgrade reiserfs-kmp-defaultUpgrade kernel-64kb-develUpgrade kernel-kvmsmall-vdsoUpgrade dtb-rockchipUpgrade kernel-default-vdsoUpgrade kernel-64kbUpgrade dtb-qcomUpgrade dtb-marvellUpgrade kselftests-kmp-64kbUpgrade kernel-macrosUpgrade kernel-docs-htmlUpgrade dtb-freescaleUpgrade dlm-kmp-64kbUpgrade kernel-devel-azureUpgrade kernel-default-extraUpgrade gfs2-kmp-rtUpgrade ocfs2-kmp-64kbUpgrade kernel-kvmsmall-develUpgrade dtb-exynosUpgrade dtb-apmUpgrade cluster-md-kmp-defaultUpgrade kernel-syms-azureUpgrade kselftests-kmp-defaultUpgrade kernel-zfcpdumpUpgrade dtb-lgUpgrade dtb-broadcomUpgrade kernel-source-azureUpgrade kernel-rt-optionalUpgrade kernel-obs-qaUpgrade kernel-default-develUpgrade kernel-azure-develUpgrade dtb-amazonUpgrade dtb-armUpgrade kernel-rt-livepatch-develUpgrade kernel-rt-vdsoUpgrade ocfs2-kmp-rtUpgrade kernel-rtUpgrade kernel-sourceUpgrade kernel-preemptUpgrade dtb-amlogicUpgrade gfs2-kmp-64kbUpgrade kernel-symsUpgrade kernel-kvmsmall | Dec 5, 2025 | Oct 15, 2025 |
| Ubuntu | — | Upgrade linux-image-oracle-6.14Upgrade linux-image-oracleUpgrade linux-image-oem-6.14Upgrade linux-image-realtimeUpgrade linux-image-6.14.0-1009-oracle-64kUpgrade linux-image-gcp-64k-6.14Upgrade linux-image-generic-64k-6.14Upgrade linux-image-6.14.0-1010-azureUpgrade linux-image-6.14.0-1006-realtimeUpgrade linux-image-awsUpgrade linux-image-realtime-6.14Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-oracle-64k-6.14Upgrade linux-image-azure-6.14Upgrade linux-image-6.14.0-1011-gcp-64kUpgrade linux-image-6.14.0-1011-gcpUpgrade linux-image-oem-24.04cUpgrade linux-image-oem-24.04aUpgrade linux-image-generic-64kUpgrade linux-image-gcp-6.14Upgrade linux-image-6.14.0-1007-oemUpgrade linux-image-aws-64kUpgrade linux-image-6.14.0-1009-awsUpgrade linux-image-gcp-64kUpgrade linux-image-6.14.0-1009-raspiUpgrade linux-image-gcpUpgrade linux-image-6.14.0-1009-oracleUpgrade linux-image-6.14.0-24-genericUpgrade linux-image-generic-6.14Upgrade linux-image-oem-24.04Upgrade linux-image-raspi-6.14Upgrade linux-image-oracle-64kUpgrade linux-image-virtual-6.14Upgrade linux-image-aws-6.14Upgrade linux-image-realtime-hwe-24.04Upgrade linux-image-aws-64k-6.14Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-raspiUpgrade linux-image-azureUpgrade linux-image-genericUpgrade linux-image-6.14.0-24-generic-64kUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.14.0-1009-aws-64kUpgrade linux-image-virtual | Jul 9, 2025 | Jul 4, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub