CVE-2026-43220

In the Linux kernel, the following vulnerability has been resolved:

iommu/amd: serialize sequence allocation under concurrent TLB invalidations

With concurrent TLB invalidations, completion wait randomly gets timed out

because cmd_sem_val was incremented outside the IOMMU spinlock, allowing

CMD_COMPL_WAIT commands to be queued out of sequence and breaking the

ordering assumption in wait_on_sem().

Move the cmd_sem_val increment under iommu->lock so completion sequence

allocation is serialized with command queuing.

And remove the unnecessary return.