IOTLB stands for I/O Translation Lookaside Buffer. It is a cache of address translations used by devices or virtualization layers to speed up lookups between device-visible addresses and real host memory. Instead of walking the full IOMMU or page-table path on every access, the system can reuse recently validated mappings.
This matters because cached translations are only safe while the underlying mapping stays valid. If a driver, vhost backend, or IOMMU configuration changes and the IOTLB is not properly invalidated, later DMA or guest device accesses may use stale mappings. That can turn a performance feature into a security flaw, enabling unintended reads, writes, or host memory corruption. Defenders look for correct invalidation, strict mapping updates, and isolation controls that force revalidation when device layout changes.