In the Linux kernel, the following vulnerability has been resolved:
iommu/vt-d: Restore context entry setup order for aliased devices
Commit 2031c469f816 ("iommu/vt-d: Add support for static identity domain") changed the context entry setup during domain attachment from a set-and-check policy to a clear-and-reset approach. This inadvertently introduced a regression affecting PCI aliased devices behind PCIe-to-PCI bridges.
Specifically, keyboard and touchpad stopped working on several Apple Macbooks with below messages:
kernel: platform pxa2xx-spi.3: Adding to iommu group 20 kernel: input: Apple SPI Keyboard as /devices/pci0000:00/0000:00:1e.3/pxa2xx-spi.3/spi_master/spi2/spi-APP000D:00/input/input0 kernel: DMAR: DRHD: handling fault status reg 3 kernel: DMAR: [DMA Read NO_PASID] Request device [00:1e.3] fault addr 0xffffa000 [fault reason 0x06] PTE Read access is not set kernel: DMAR: DRHD: handling fault status reg 3 kernel: DMAR: [DMA Read NO_PASID] Request device [00:1e.3] fault addr 0xffffa000 [fault reason 0x06] PTE Read access is not set kernel: applespi spi-APP000D:00: Error writing to device: 01 0e 00 00 kernel: DMAR: DRHD: handling fault status reg 3 kernel: DMAR: [DMA Read NO_PASID] Request device [00:1e.3] fault addr 0xffffa000 [fault reason 0x06] PTE Read access is not set kernel: DMAR: DRHD: handling fault status reg 3 kernel: applespi spi-APP000D:00: Error writing to device: 01 0e 00 00
Fix this by restoring the previous context setup order.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade bpftool-debuginfoUpgrade kernel6.12-debuginfo-common-x86_64Upgrade perf6.12Upgrade kernel-libbpfUpgrade kernel6.12Upgrade bpftoolUpgrade kernel6.12-modules-extraUpgrade kernel-tools-debuginfoUpgrade kernel6.12-debuginfo-common-aarch64Upgrade kernel-toolsUpgrade kernel-libbpf-staticUpgrade kernel-libbpf-debuginfoUpgrade kernel-headersUpgrade kernel-modules-extra-commonUpgrade kernel-livepatch-6.12.35-55.103Upgrade kernel6.12-debuginfoUpgrade kernel-tools-develUpgrade kernel-develUpgrade kernel-libbpf-develUpgrade python3-perf6.12Upgrade python3-perf6.12-debuginfoUpgrade perf6.12-debuginfo | Sep 9, 2025 | Jul 4, 2025 |
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jul 4, 2025 |
| Suse | — | Upgrade kernel-zfcpdumpUpgrade kernel-default-extraUpgrade kernel-source-azureUpgrade kernel-default-develUpgrade dtb-apmUpgrade cluster-md-kmp-defaultUpgrade dlm-kmp-64kbUpgrade dtb-freescaleUpgrade kernel-rt-optionalUpgrade kernel-obs-qaUpgrade dtb-marvellUpgrade kernel-docs-htmlUpgrade kernel-devel-azureUpgrade kernel-macrosUpgrade kernel-preemptUpgrade kernel-sourceUpgrade dtb-qcomUpgrade kernel-64kbUpgrade dtb-amlogicUpgrade gfs2-kmp-rtUpgrade kernel-kvmsmall-vdsoUpgrade kselftests-kmp-64kbUpgrade dtb-broadcomUpgrade dtb-lgUpgrade kernel-kvmsmall-develUpgrade dtb-exynosUpgrade kselftests-kmp-defaultUpgrade kernel-azure-develUpgrade ocfs2-kmp-64kbUpgrade kernel-default-vdsoUpgrade dtb-armUpgrade kernel-kvmsmallUpgrade kernel-symsUpgrade kernel-syms-azureUpgrade dtb-amazonUpgrade dtb-rockchipUpgrade kernel-rtUpgrade kernel-rt-livepatch-develUpgrade kernel-rt-vdsoUpgrade ocfs2-kmp-rtUpgrade gfs2-kmp-64kbUpgrade gfs2-kmp-defaultUpgrade dtb-nvidiaUpgrade kernel-azureUpgrade kernel-default-optionalUpgrade dlm-kmp-defaultUpgrade kernel-default-livepatchUpgrade kernel-default-baseUpgrade dtb-caviumUpgrade dtb-xilinxUpgrade dtb-renesasUpgrade dtb-mediatekUpgrade dtb-appleUpgrade kernel-source-vanillaUpgrade kernel-rt-extraUpgrade kernel-default-livepatch-develUpgrade dtb-socionextUpgrade dtb-sprdUpgrade kernel-64kb-develUpgrade dlm-kmp-rtUpgrade dtb-allwinnerUpgrade dtb-alteraUpgrade kernel-rt-develUpgrade kernel-64kb-extraUpgrade kernel-64kb-optionalUpgrade ocfs2-kmp-defaultUpgrade kernel-obs-buildUpgrade dtb-hisiliconUpgrade kernel-defaultUpgrade cluster-md-kmp-64kbUpgrade kernel-preempt-develUpgrade kernel-develUpgrade kernel-rt-livepatchUpgrade kernel-docsUpgrade dtb-amdUpgrade cluster-md-kmp-rtUpgrade reiserfs-kmp-defaultUpgrade kselftests-kmp-rt | Dec 5, 2025 | Oct 15, 2025 |
| Ubuntu | — | Upgrade linux-image-6.14.0-1011-gcp-64kUpgrade linux-image-oracleUpgrade linux-image-6.14.0-1010-azureUpgrade linux-image-generic-64k-6.14Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-awsUpgrade linux-image-realtime-6.14Upgrade linux-image-oracle-6.14Upgrade linux-image-azure-6.14Upgrade linux-image-oracle-64k-6.14Upgrade linux-image-oem-6.14Upgrade linux-image-gcp-64k-6.14Upgrade linux-image-6.14.0-1009-oracle-64kUpgrade linux-image-realtimeUpgrade linux-image-6.14.0-1006-realtimeUpgrade linux-image-6.14.0-24-generic-64kUpgrade linux-image-generic-6.14Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-generic-64kUpgrade linux-image-gcp-6.14Upgrade linux-image-6.14.0-1009-awsUpgrade linux-image-genericUpgrade linux-image-6.14.0-24-genericUpgrade linux-image-raspi-6.14Upgrade linux-image-oracle-64kUpgrade linux-image-6.14.0-1009-oracleUpgrade linux-image-virtual-6.14Upgrade linux-image-aws-64kUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-gcp-64kUpgrade linux-image-6.14.0-1007-oemUpgrade linux-image-realtime-hwe-24.04Upgrade linux-image-aws-64k-6.14Upgrade linux-image-azureUpgrade linux-image-aws-6.14Upgrade linux-image-6.14.0-1009-aws-64kUpgrade linux-image-oem-24.04cUpgrade linux-image-oem-24.04aUpgrade linux-image-virtualUpgrade linux-image-gcpUpgrade linux-image-oem-24.04Upgrade linux-image-raspiUpgrade linux-image-6.14.0-1009-raspiUpgrade linux-image-6.14.0-1011-gcp | Jul 9, 2025 | Jul 4, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub