Critical· 9.3official fix available
CVE-2026-89448
A flaw in the Linux kernel’s IOMMU subsystem could let an attacker force the IOMMU on while disabling ACS, potentially giving them unrestricted access to hardware devices.
publishedSep 11, 2026
last modifiedSep 13, 2026
sourcesNVD
severity · cvss
9.3
critical · how bad it is
exploitation · epss
<1%
6th percentile · chance of exploitation in 30 days
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
auto-deletes from the system
counting…on Oct 13, 2026
An official fix is available, so this entry is kept for 30 days and then removed automatically.
01
Who is affected
Linux kernel, specifically the iommu/vt-d component.
02
Real-world impact
An attacker could gain full control over the system’s I/O devices, compromising confidentiality, integrity, and availability.
03
Why this severity
The CVSS score of 9.3 reflects that the flaw can be triggered locally without privileges, changes the system scope, and gives an attacker complete control over all three core security properties.
04
What to do about it
official fix available
recommended steps
- 011. Update the Linux kernel to a version that includes the fix for CVE-2026-89448.
- 022. Verify that the kernel version is at least the patched release.
NVD-referenced vendor advisory
05
Timeline
- Sep 11, 2026 · 2d agoPublishedDisclosed and added to the National Vulnerability Database.
- Sep 13, 2026 · 8h agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
06
How it’s attacked
Attack vectorLocal
Attack complexityLow
Privileges requiredNone
User interactionNone needed
ScopeChanged
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
07
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →