CVE-2026-53053 (GCVE-0-2026-53053)
Vulnerability from cvelistv5
Published
2026-06-24 16:29
Modified
2026-08-05 12:32
Severity ?
8.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix clone_alias() to use the original device's devid Currently clone_alias() assumes first argument (pdev) is always the original device pointer. This function is called by pci_for_each_dma_alias() which based on topology decides to send original or alias device details in first argument. This meant that the source devid used to look up and copy the DTE may be incorrect, leading to wrong or stale DTE entries being propagated to alias device. Fix this by passing the original pdev as the opaque data argument to both the direct clone_alias() call and pci_for_each_dma_alias(). Inside clone_alias(), retrieve the original device from data and compute devid from it.
References
Impacted products
Vendor Product Version
Linux Linux Version: 3332364e4ebc0581d133a334645a20fd13b580f1
Version: 3332364e4ebc0581d133a334645a20fd13b580f1
Version: 3332364e4ebc0581d133a334645a20fd13b580f1
Version: 3332364e4ebc0581d133a334645a20fd13b580f1
Version: 1f03a258f20f1699ede29bb40804074db9398a0d
Version: 5.4.17   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/amd/iommu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "dbd76a537d8cb814e7f5b795ab21ecb7949c821d",
              "status": "affected",
              "version": "3332364e4ebc0581d133a334645a20fd13b580f1",
              "versionType": "git"
            },
            {
              "lessThan": "20b3c566e2702e5d4d0545be8a97029a2eebcc0e",
              "status": "affected",
              "version": "3332364e4ebc0581d133a334645a20fd13b580f1",
              "versionType": "git"
            },
            {
              "lessThan": "dae251ff11d2d2208a029f98923756831cefec46",
              "status": "affected",
              "version": "3332364e4ebc0581d133a334645a20fd13b580f1",
              "versionType": "git"
            },
            {
              "lessThan": "faad224fe0f0857a04ff2eb3c90f0de57f47d0f3",
              "status": "affected",
              "version": "3332364e4ebc0581d133a334645a20fd13b580f1",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1f03a258f20f1699ede29bb40804074db9398a0d",
              "versionType": "git"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.17",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/amd/iommu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.5"
            },
            {
              "lessThan": "5.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.91",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.91",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.33",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.10",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/amd: Fix clone_alias() to use the original device\u0027s devid\n\nCurrently clone_alias() assumes first argument (pdev) is always the\noriginal device pointer. This function is called by\npci_for_each_dma_alias() which based on topology decides to send\noriginal or alias device details in first argument.\n\nThis meant that the source devid used to look up and copy the DTE\nmay be incorrect, leading to wrong or stale DTE entries being\npropagated to alias device.\n\nFix this by passing the original pdev as the opaque data argument to\nboth the direct clone_alias() call and pci_for_each_dma_alias(). Inside\nclone_alias(), retrieve the original device from data and compute devid\nfrom it."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached through local PCI/IOMMU domain setup and updates, including VFIO/IOMMUFD or VM device-passthrough attach paths for a delegated device. It is not directly reachable by remote packets, but a local tenant or process controlling the assigned device can exercise the affected DMA alias state.\nAC:L - Once the system has an AMD IOMMU and a PCI topology/device with DMA aliases, the wrong DTE clone occurs deterministically during alias setup or domain attach. There is no race or timing condition required.\nPR:L - Exploitation requires control of, or access to, an assigned/owned PCI device or its IOMMUFD/VFIO context, but not host-root privileges in the target host kernel. In delegated passthrough deployments this is reachable by a low-privileged tenant context.\nUI:N - No victim user action is needed after the vulnerable device/topology is present and the device is attached or used. The attacker can trigger DMA behavior through the assigned device context.\nS:C - The bug can violate the IOMMU/DMA isolation boundary by applying a wrong or stale device-table entry to an alias requester ID. Per kernel guidance, IOMMU/DMA boundary bypass changes scope.\nC:H - A wrong/stale DTE can give an alias requester ID DMA access under the wrong page table or domain, enabling reads of memory outside the intended DMA isolation boundary. This supports high confidentiality impact in the most severe reasonable passthrough scenario.\nI:H - The DTE contains DMA translation and read/write permission state, so propagating the wrong entry can allow DMA writes to memory outside the intended domain. That can corrupt host or peer-domain memory and supports high integrity impact.\nA:H - Wrong DMA translations can produce repeated IOMMU faults, device failure, or memory corruption leading to kernel instability or crash. This supports high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:32:57.238Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/dbd76a537d8cb814e7f5b795ab21ecb7949c821d"
        },
        {
          "url": "https://git.kernel.org/stable/c/20b3c566e2702e5d4d0545be8a97029a2eebcc0e"
        },
        {
          "url": "https://git.kernel.org/stable/c/dae251ff11d2d2208a029f98923756831cefec46"
        },
        {
          "url": "https://git.kernel.org/stable/c/faad224fe0f0857a04ff2eb3c90f0de57f47d0f3"
        }
      ],
      "title": "iommu/amd: Fix clone_alias() to use the original device\u0027s devid",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53053",
    "datePublished": "2026-06-24T16:29:59.093Z",
    "dateReserved": "2026-06-09T07:44:35.381Z",
    "dateUpdated": "2026-08-05T12:32:57.238Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.