CVE-2026-68329

This CVE reveals a semantic rather than visibility bug in the IOMMU command-queue driver. The vulnerability stems from a flag called need_sync whose actual meaning was never precisely specified: false means only that a CWAIT (completion-wait) command was queued after the last sync command, not that all prior commands have completed in hardware. The original code assumed false meant no synchronization was required, treating it as a boolean predicate rather than a point in a causal sequence. The race unfolds across CPUs in a multi-tenant environment. CPU1 queues a CWAIT (which clears need_sync), CPU2 queues an invalidation, observes the cleared flag, and returns without waiting — then frees page-table memory while the IOMMU may still be walking those structures. This is a use-after-free with physical memory read/write primitives and cross-VM scope. The critical detail: need_sync is per-IOMMU, shared by all domains and devices behind that IOMMU. One driver's optimization mistake becomes a container escape vector for every workload sharing that hardware — CVSS 8.8 measures technical severity but doesn't capture this blast radius. The fix takes the lock before testing need_sync, transforming the check from a potentially-stale observation into a point in the driver's serial order. When need_sync is false, waiting for the last allocated sequence number guarantees that all prior commands — possibly queued by other CPUs — have drained, because CWAIT is FIFO-ordered after them. This corrects the semantic error but demotes the fast path: the optimization wasn't preserved, it was traded for correctness. The lock acquisition exposes that the real invariant is causal ordering across CPUs, not flag state. The deeper problem is that the IOMMU subsystem's API makes completion guarantees implicit rather than explicit. The name need_sync invites the reading 'do we need to sync?' when the actual contract is 'has a CWAIT been queued since the last sync?' — a fundamentally different semantic. Drivers optimizing based on assumed atomicity of compound operations will continue hitting this pattern until the API makes cross-driver causal dependencies statically expressible rather than encoded in shared flags.

Reviewed through automated stages and approved by a human before publication.