In the Linux kernel, the following vulnerability has been resolved:
iommu/vt-d: Restore context entry setup order for aliased devices
Commit 2031c469f816 ("iommu/vt-d: Add support for static identity domain") changed the context entry setup during domain attachment from a set-and-check policy to a clear-and-reset approach. This inadvertently introduced a regression affecting PCI aliased devices behind PCIe-to-PCI bridges.
Specifically, keyboard and touchpad stopped working on several Apple Macbooks with below messages:
kernel: platform pxa2xx-spi.3: Adding to iommu group 20 kernel: input: Apple SPI Keyboard as /devices/pci0000:00/0000:00:1e.3/pxa2xx-spi.3/spi_master/spi2/spi-APP000D:00/input/input0 kernel: DMAR: DRHD: handling fault status reg 3 kernel: DMAR: [DMA Read NO_PASID] Request device [00:1e.3] fault addr 0xffffa000 [fault reason 0x06] PTE Read access is not set kernel: DMAR: DRHD: handling fault status reg 3 kernel: DMAR: [DMA Read NO_PASID] Request device [00:1e.3] fault addr 0xffffa000 [fault reason 0x06] PTE Read access is not set kernel: applespi spi-APP000D:00: Error writing to device: 01 0e 00 00 kernel: DMAR: DRHD: handling fault status reg 3 kernel: DMAR: [DMA Read NO_PASID] Request device [00:1e.3] fault addr 0xffffa000 [fault reason 0x06] PTE Read access is not set kernel: DMAR: DRHD: handling fault status reg 3 kernel: applespi spi-APP000D:00: Error writing to device: 01 0e 00 00
Fix this by restoring the previous context setup order.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade bpftool-debuginfoUpgrade kernel-toolsUpgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel6.12-debuginfo-common-aarch64Upgrade kernel-libbpf-staticUpgrade kernel-tools-debuginfoUpgrade bpftoolUpgrade kernel-libbpf-debuginfoUpgrade kernel6.12Upgrade perf6.12Upgrade kernel6.12-modules-extraUpgrade kernel-libbpfUpgrade kernel6.12-debuginfoUpgrade kernel-libbpf-develUpgrade perf6.12-debuginfoUpgrade kernel-tools-develUpgrade kernel-modules-extra-commonUpgrade kernel-livepatch-6.12.35-55.103Upgrade kernel-develUpgrade python3-perf6.12-debuginfoUpgrade kernel-headersUpgrade python3-perf6.12 | Sep 9, 2025 | Jul 4, 2025 |
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jul 4, 2025 |
| Suse | — | Upgrade kernel-obs-qaUpgrade kernel-devel-azureUpgrade kernel-default-extraUpgrade kernel-rt-optionalUpgrade dlm-kmp-64kbUpgrade dtb-freescaleUpgrade dtb-marvellUpgrade dtb-qcomUpgrade kernel-source-azureUpgrade dtb-amazonUpgrade kselftests-kmp-64kbUpgrade kernel-kvmsmall-vdsoUpgrade kernel-macrosUpgrade ocfs2-kmp-64kbUpgrade kernel-preemptUpgrade kernel-sourceUpgrade kernel-docs-htmlUpgrade dtb-exynosUpgrade dtb-amlogicUpgrade gfs2-kmp-rtUpgrade kernel-kvmsmall-develUpgrade kernel-64kbUpgrade kernel-azure-develUpgrade kernel-default-develUpgrade kernel-kvmsmallUpgrade kernel-default-vdsoUpgrade dtb-armUpgrade kernel-symsUpgrade gfs2-kmp-64kbUpgrade dtb-lgUpgrade dtb-rockchipUpgrade kernel-syms-azureUpgrade kernel-zfcpdumpUpgrade dtb-apmUpgrade kernel-rtUpgrade cluster-md-kmp-defaultUpgrade kernel-rt-livepatch-develUpgrade kernel-rt-vdsoUpgrade ocfs2-kmp-rtUpgrade kselftests-kmp-defaultUpgrade dtb-broadcomUpgrade dtb-allwinnerUpgrade dtb-xilinxUpgrade kernel-preempt-develUpgrade kernel-obs-buildUpgrade kernel-default-livepatchUpgrade kernel-docsUpgrade reiserfs-kmp-defaultUpgrade kernel-rt-livepatchUpgrade dtb-amdUpgrade cluster-md-kmp-rtUpgrade kernel-develUpgrade dlm-kmp-defaultUpgrade kselftests-kmp-rtUpgrade kernel-default-optionalUpgrade kernel-defaultUpgrade gfs2-kmp-defaultUpgrade dtb-renesasUpgrade dtb-mediatekUpgrade dtb-appleUpgrade dtb-caviumUpgrade cluster-md-kmp-64kbUpgrade kernel-source-vanillaUpgrade kernel-default-baseUpgrade kernel-default-livepatch-develUpgrade kernel-rt-develUpgrade kernel-64kb-optionalUpgrade kernel-64kb-develUpgrade dtb-sprdUpgrade dtb-socionextUpgrade dlm-kmp-rtUpgrade kernel-rt-extraUpgrade kernel-64kb-extraUpgrade dtb-alteraUpgrade dtb-nvidiaUpgrade kernel-azureUpgrade dtb-hisiliconUpgrade ocfs2-kmp-default | Dec 5, 2025 | Oct 15, 2025 |
| Ubuntu | — | Upgrade linux-image-generic-64kUpgrade linux-image-generic-6.14Upgrade linux-image-gcp-64kUpgrade linux-image-genericUpgrade linux-image-aws-64kUpgrade linux-image-realtime-hwe-24.04Upgrade linux-image-6.14.0-1009-raspiUpgrade linux-image-aws-6.14Upgrade linux-image-6.14.0-1007-oemUpgrade linux-image-virtualUpgrade linux-image-raspiUpgrade linux-image-oem-24.04cUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.14.0-24-generic-64kUpgrade linux-image-oem-24.04aUpgrade linux-image-aws-64k-6.14Upgrade linux-image-gcp-6.14Upgrade linux-image-6.14.0-24-genericUpgrade linux-image-6.14.0-1009-oracleUpgrade linux-image-virtual-6.14Upgrade linux-image-raspi-6.14Upgrade linux-image-oem-24.04Upgrade linux-image-gcpUpgrade linux-image-oracle-64kUpgrade linux-image-6.14.0-1009-aws-64kUpgrade linux-image-azureUpgrade linux-image-6.14.0-1011-gcpUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.14.0-1009-awsUpgrade linux-image-realtimeUpgrade linux-image-6.14.0-1009-oracle-64kUpgrade linux-image-gcp-64k-6.14Upgrade linux-image-oracle-64k-6.14Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.14.0-1010-azureUpgrade linux-image-6.14.0-1011-gcp-64kUpgrade linux-image-generic-64k-6.14Upgrade linux-image-oracle-6.14Upgrade linux-image-awsUpgrade linux-image-oracleUpgrade linux-image-oem-6.14Upgrade linux-image-azure-6.14Upgrade linux-image-6.14.0-1006-realtimeUpgrade linux-image-realtime-6.14 | Jul 9, 2025 | Jul 4, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub