In the Linux kernel, the following vulnerability has been resolved:
iommu/vt-d: Restore context entry setup order for aliased devices
Commit 2031c469f816 ("iommu/vt-d: Add support for static identity domain") changed the context entry setup during domain attachment from a set-and-check policy to a clear-and-reset approach. This inadvertently introduced a regression affecting PCI aliased devices behind PCIe-to-PCI bridges.
Specifically, keyboard and touchpad stopped working on several Apple Macbooks with below messages:
kernel: platform pxa2xx-spi.3: Adding to iommu group 20 kernel: input: Apple SPI Keyboard as /devices/pci0000:00/0000:00:1e.3/pxa2xx-spi.3/spi_master/spi2/spi-APP000D:00/input/input0 kernel: DMAR: DRHD: handling fault status reg 3 kernel: DMAR: [DMA Read NO_PASID] Request device [00:1e.3] fault addr 0xffffa000 [fault reason 0x06] PTE Read access is not set kernel: DMAR: DRHD: handling fault status reg 3 kernel: DMAR: [DMA Read NO_PASID] Request device [00:1e.3] fault addr 0xffffa000 [fault reason 0x06] PTE Read access is not set kernel: applespi spi-APP000D:00: Error writing to device: 01 0e 00 00 kernel: DMAR: DRHD: handling fault status reg 3 kernel: DMAR: [DMA Read NO_PASID] Request device [00:1e.3] fault addr 0xffffa000 [fault reason 0x06] PTE Read access is not set kernel: DMAR: DRHD: handling fault status reg 3 kernel: applespi spi-APP000D:00: Error writing to device: 01 0e 00 00
Fix this by restoring the previous context setup order.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade kernel6.12Upgrade perf6.12Upgrade kernel-tools-debuginfoUpgrade kernel-toolsUpgrade kernel6.12-debuginfo-common-aarch64Upgrade kernel6.12-debuginfo-common-x86_64Upgrade bpftool-debuginfoUpgrade bpftoolUpgrade kernel6.12-modules-extraUpgrade kernel-libbpfUpgrade kernel-libbpf-staticUpgrade kernel-libbpf-debuginfoUpgrade kernel6.12-debuginfoUpgrade python3-perf6.12Upgrade perf6.12-debuginfoUpgrade kernel-develUpgrade kernel-livepatch-6.12.35-55.103Upgrade kernel-modules-extra-commonUpgrade kernel-tools-develUpgrade python3-perf6.12-debuginfoUpgrade kernel-headersUpgrade kernel-libbpf-devel | Sep 9, 2025 | Jul 4, 2025 |
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jul 4, 2025 |
| Suse | — | Upgrade kernel-kvmsmall-vdsoUpgrade dtb-marvellUpgrade kernel-docs-htmlUpgrade dtb-amlogicUpgrade dtb-freescaleUpgrade dtb-exynosUpgrade kernel-preemptUpgrade kernel-sourceUpgrade dtb-qcomUpgrade kernel-kvmsmall-develUpgrade gfs2-kmp-rtUpgrade ocfs2-kmp-64kbUpgrade kernel-default-extraUpgrade kernel-devel-azureUpgrade kernel-macrosUpgrade kselftests-kmp-64kbUpgrade kernel-64kbUpgrade ocfs2-kmp-rtUpgrade kernel-rt-optionalUpgrade kernel-obs-qaUpgrade kernel-azure-develUpgrade kernel-source-azureUpgrade gfs2-kmp-64kbUpgrade dtb-armUpgrade dtb-amazonUpgrade kernel-rt-livepatch-develUpgrade kernel-default-develUpgrade kernel-default-vdsoUpgrade cluster-md-kmp-defaultUpgrade kernel-kvmsmallUpgrade kselftests-kmp-defaultUpgrade dtb-apmUpgrade kernel-symsUpgrade kernel-rt-vdsoUpgrade dtb-broadcomUpgrade dtb-lgUpgrade dlm-kmp-64kbUpgrade dtb-rockchipUpgrade kernel-syms-azureUpgrade kernel-rtUpgrade kernel-zfcpdumpUpgrade dtb-renesasUpgrade kernel-azureUpgrade kernel-rt-extraUpgrade kernel-64kb-optionalUpgrade dtb-xilinxUpgrade dtb-mediatekUpgrade dtb-hisiliconUpgrade gfs2-kmp-defaultUpgrade dtb-nvidiaUpgrade kernel-develUpgrade reiserfs-kmp-defaultUpgrade ocfs2-kmp-defaultUpgrade kernel-rt-livepatchUpgrade kernel-docsUpgrade dtb-amdUpgrade cluster-md-kmp-64kbUpgrade kernel-preempt-develUpgrade kernel-obs-buildUpgrade kernel-default-optionalUpgrade kernel-defaultUpgrade dtb-caviumUpgrade kernel-default-livepatch-develUpgrade kernel-64kb-develUpgrade dtb-sprdUpgrade dtb-socionextUpgrade dlm-kmp-rtUpgrade dtb-allwinnerUpgrade kselftests-kmp-rtUpgrade dlm-kmp-defaultUpgrade kernel-source-vanillaUpgrade kernel-64kb-extraUpgrade cluster-md-kmp-rtUpgrade kernel-default-livepatchUpgrade kernel-default-baseUpgrade dtb-appleUpgrade dtb-alteraUpgrade kernel-rt-devel | Dec 5, 2025 | Oct 15, 2025 |
| Ubuntu | — | Upgrade linux-image-awsUpgrade linux-image-realtime-6.14Upgrade linux-image-realtimeUpgrade linux-image-oracleUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.14.0-1009-oracle-64kUpgrade linux-image-gcp-64k-6.14Upgrade linux-image-oracle-6.14Upgrade linux-image-6.14.0-1006-realtimeUpgrade linux-image-oem-6.14Upgrade linux-image-oracle-64k-6.14Upgrade linux-image-azure-6.14Upgrade linux-image-6.14.0-1011-gcp-64kUpgrade linux-image-generic-64k-6.14Upgrade linux-image-6.14.0-1010-azureUpgrade linux-image-6.14.0-1009-aws-64kUpgrade linux-image-oracle-64kUpgrade linux-image-6.14.0-1009-oracleUpgrade linux-image-virtual-6.14Upgrade linux-image-raspi-6.14Upgrade linux-image-6.14.0-24-genericUpgrade linux-image-6.14.0-1011-gcpUpgrade linux-image-virtualUpgrade linux-image-gcp-64kUpgrade linux-image-6.14.0-1007-oemUpgrade linux-image-6.14.0-1009-raspiUpgrade linux-image-aws-64kUpgrade linux-image-raspiUpgrade linux-image-oem-24.04aUpgrade linux-image-oem-24.04cUpgrade linux-image-aws-6.14Upgrade linux-image-oem-24.04Upgrade linux-image-gcpUpgrade linux-image-generic-6.14Upgrade linux-image-6.14.0-24-generic-64kUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-genericUpgrade linux-image-6.14.0-1009-awsUpgrade linux-image-azureUpgrade linux-image-realtime-hwe-24.04Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-aws-64k-6.14Upgrade linux-image-generic-64kUpgrade linux-image-gcp-6.14 | Jul 9, 2025 | Jul 4, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub