Cross-domain memory access via torn VT-d context

Race condition in the Intel VT-d IOMMU in Linux allows attackers with a DMA-capable PCIe device to read or write cross-domain memory. The copied_context_tear_down() path clears two halves of a 128-bit context entry while its Present bit remains set, then invalidates caches without first flushing the entry, allowing hardware to consume mixed fields. Reachability requires crash-kernel attachment with translation already enabled and in-flight device DMA; the timing-dependent result includes host-memory disclosure or overwrite, faults, panic, or an aborted crash dump.