CVE-2026-43253 (GCVE-0-2026-43253)
Vulnerability from cvelistv5
Published
2026-05-06 11:28
Modified
2026-08-05 12:26
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: iommu/amd: move wait_on_sem() out of spinlock With iommu.strict=1, the existing completion wait path can cause soft lockups under stressed environment, as wait_on_sem() busy-waits under the spinlock with interrupts disabled. Move the completion wait in iommu_completion_wait() out of the spinlock. wait_on_sem() only polls the hardware-updated cmd_sem and does not require iommu->lock, so holding the lock during the busy wait unnecessarily increases contention and extends the time with interrupts disabled.
References
Impacted products
Vendor Product Version
Linux Linux Version: 4bf5beef578e46393f11eb69dda7d17a065e05ff
Version: 4bf5beef578e46393f11eb69dda7d17a065e05ff
Version: 4bf5beef578e46393f11eb69dda7d17a065e05ff
Version: 4bf5beef578e46393f11eb69dda7d17a065e05ff
Version: 4bf5beef578e46393f11eb69dda7d17a065e05ff
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/amd/iommu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f2f65b28d802a667119147444ec2ae33eebf9a58",
              "status": "affected",
              "version": "4bf5beef578e46393f11eb69dda7d17a065e05ff",
              "versionType": "git"
            },
            {
              "lessThan": "715c263119fd1b918a9fcbd8a36ea5b604a46324",
              "status": "affected",
              "version": "4bf5beef578e46393f11eb69dda7d17a065e05ff",
              "versionType": "git"
            },
            {
              "lessThan": "e15768e68820142077bbca402d8e902f64ade1b0",
              "status": "affected",
              "version": "4bf5beef578e46393f11eb69dda7d17a065e05ff",
              "versionType": "git"
            },
            {
              "lessThan": "496269d12072ecb219826485bdbec70c92a8eef5",
              "status": "affected",
              "version": "4bf5beef578e46393f11eb69dda7d17a065e05ff",
              "versionType": "git"
            },
            {
              "lessThan": "d2a0cac10597068567d336e85fa3cbdbe8ca62bf",
              "status": "affected",
              "version": "4bf5beef578e46393f11eb69dda7d17a065e05ff",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/amd/iommu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.9"
            },
            {
              "lessThan": "4.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.128",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.16",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.6",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/amd: move wait_on_sem() out of spinlock\n\nWith iommu.strict=1, the existing completion wait path can cause soft\nlockups under stressed environment, as wait_on_sem() busy-waits under the\nspinlock with interrupts disabled.\n\nMove the completion wait in iommu_completion_wait() out of the spinlock.\nwait_on_sem() only polls the hardware-updated cmd_sem and does not require\niommu-\u003elock, so holding the lock during the busy wait unnecessarily\nincreases contention and extends the time with interrupts disabled."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - On AMD systems where the IOMMU protects a PCIe NIC, received packets can drive NIC RX cleanup through DMA unmap, IOTLB sync, amd_iommu_iotlb_sync(), iommu_completion_wait(), and wait_on_sem(). A remote peer can generate this traffic without local system access.\nAC:L - Triggering requires sustained IOMMU flush pressure, but the attacker can create that pressure by sending traffic and no uncontrollable race, memory layout, or victim action is needed. The affected AMD IOMMU/translated-DMA deployment is assumed for scoring.\nPR:N - The highest reasonable path is unauthenticated network receive processing on an internet-facing server NIC. No local account, capability, or namespace access is required to cause packet-driven DMA cleanup.\nUI:N - No victim user action is required once the affected system is running and receiving network traffic. The kernel/NIC interrupt and NAPI paths process packets automatically.\nS:U - The issue causes a host-kernel availability failure within the same security authority. It does not bypass IOMMU/DMA isolation, escape a VM, or cross into another security scope.\nC:N - The bug is a busy wait under a spinlock with interrupts disabled while polling a hardware-updated command semaphore. There is no memory corruption, out-of-bounds read, or information disclosure primitive.\nI:N - The vulnerable path does not corrupt memory or provide an attacker-controlled write. It only causes excessive locked/IRQ-disabled waiting during IOMMU command completion.\nA:H - The fix and related reports describe soft lockups/RCU stalls caused by wait_on_sem() spinning while holding the IOMMU lock with interrupts disabled. Repeated triggering can hang or severely stall the kernel, so availability impact is high."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:26:53.719Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f2f65b28d802a667119147444ec2ae33eebf9a58"
        },
        {
          "url": "https://git.kernel.org/stable/c/715c263119fd1b918a9fcbd8a36ea5b604a46324"
        },
        {
          "url": "https://git.kernel.org/stable/c/e15768e68820142077bbca402d8e902f64ade1b0"
        },
        {
          "url": "https://git.kernel.org/stable/c/496269d12072ecb219826485bdbec70c92a8eef5"
        },
        {
          "url": "https://git.kernel.org/stable/c/d2a0cac10597068567d336e85fa3cbdbe8ca62bf"
        }
      ],
      "title": "iommu/amd: move wait_on_sem() out of spinlock",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43253",
    "datePublished": "2026-05-06T11:28:43.160Z",
    "dateReserved": "2026-05-01T14:12:55.996Z",
    "dateUpdated": "2026-08-05T12:26:53.719Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.