CVE-2026-53053 (GCVE-0-2026-53053)

Vulnerability from cvelistv5 – Published: 2026-06-24 16:29 – Updated: 2026-08-05 12:32
VLAI
Title
iommu/amd: Fix clone_alias() to use the original device's devid
Summary
In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix clone_alias() to use the original device's devid Currently clone_alias() assumes first argument (pdev) is always the original device pointer. This function is called by pci_for_each_dma_alias() which based on topology decides to send original or alias device details in first argument. This meant that the source devid used to look up and copy the DTE may be incorrect, leading to wrong or stale DTE entries being propagated to alias device. Fix this by passing the original pdev as the opaque data argument to both the direct clone_alias() call and pci_for_each_dma_alias(). Inside clone_alias(), retrieve the original device from data and compute devid from it.
Severity
8.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 3332364e4ebc0581d133a334645a20fd13b580f1 , < dbd76a537d8cb814e7f5b795ab21ecb7949c821d (git)
Affected: 3332364e4ebc0581d133a334645a20fd13b580f1 , < 20b3c566e2702e5d4d0545be8a97029a2eebcc0e (git)
Affected: 3332364e4ebc0581d133a334645a20fd13b580f1 , < dae251ff11d2d2208a029f98923756831cefec46 (git)
Affected: 3332364e4ebc0581d133a334645a20fd13b580f1 , < faad224fe0f0857a04ff2eb3c90f0de57f47d0f3 (git)
Affected: 1f03a258f20f1699ede29bb40804074db9398a0d (git)
Affected: 5.4.17 , < 5.5 (semver)
Create a notification for this product.
Linux Linux Affected: 5.5
Unaffected: 0 , < 5.5 (semver)
Unaffected: 6.12.91 , ≤ 6.12.* (semver)
Unaffected: 6.18.33 , ≤ 6.18.* (semver)
Unaffected: 7.0.10 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/amd/iommu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "dbd76a537d8cb814e7f5b795ab21ecb7949c821d",
              "status": "affected",
              "version": "3332364e4ebc0581d133a334645a20fd13b580f1",
              "versionType": "git"
            },
            {
              "lessThan": "20b3c566e2702e5d4d0545be8a97029a2eebcc0e",
              "status": "affected",
              "version": "3332364e4ebc0581d133a334645a20fd13b580f1",
              "versionType": "git"
            },
            {
              "lessThan": "dae251ff11d2d2208a029f98923756831cefec46",
              "status": "affected",
              "version": "3332364e4ebc0581d133a334645a20fd13b580f1",
              "versionType": "git"
            },
            {
              "lessThan": "faad224fe0f0857a04ff2eb3c90f0de57f47d0f3",
              "status": "affected",
              "version": "3332364e4ebc0581d133a334645a20fd13b580f1",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1f03a258f20f1699ede29bb40804074db9398a0d",
              "versionType": "git"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.17",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/amd/iommu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.5"
            },
            {
              "lessThan": "5.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.91",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.91",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.33",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.10",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/amd: Fix clone_alias() to use the original device\u0027s devid\n\nCurrently clone_alias() assumes first argument (pdev) is always the\noriginal device pointer. This function is called by\npci_for_each_dma_alias() which based on topology decides to send\noriginal or alias device details in first argument.\n\nThis meant that the source devid used to look up and copy the DTE\nmay be incorrect, leading to wrong or stale DTE entries being\npropagated to alias device.\n\nFix this by passing the original pdev as the opaque data argument to\nboth the direct clone_alias() call and pci_for_each_dma_alias(). Inside\nclone_alias(), retrieve the original device from data and compute devid\nfrom it."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached through local PCI/IOMMU domain setup and updates, including VFIO/IOMMUFD or VM device-passthrough attach paths for a delegated device. It is not directly reachable by remote packets, but a local tenant or process controlling the assigned device can exercise the affected DMA alias state.\nAC:L - Once the system has an AMD IOMMU and a PCI topology/device with DMA aliases, the wrong DTE clone occurs deterministically during alias setup or domain attach. There is no race or timing condition required.\nPR:L - Exploitation requires control of, or access to, an assigned/owned PCI device or its IOMMUFD/VFIO context, but not host-root privileges in the target host kernel. In delegated passthrough deployments this is reachable by a low-privileged tenant context.\nUI:N - No victim user action is needed after the vulnerable device/topology is present and the device is attached or used. The attacker can trigger DMA behavior through the assigned device context.\nS:C - The bug can violate the IOMMU/DMA isolation boundary by applying a wrong or stale device-table entry to an alias requester ID. Per kernel guidance, IOMMU/DMA boundary bypass changes scope.\nC:H - A wrong/stale DTE can give an alias requester ID DMA access under the wrong page table or domain, enabling reads of memory outside the intended DMA isolation boundary. This supports high confidentiality impact in the most severe reasonable passthrough scenario.\nI:H - The DTE contains DMA translation and read/write permission state, so propagating the wrong entry can allow DMA writes to memory outside the intended domain. That can corrupt host or peer-domain memory and supports high integrity impact.\nA:H - Wrong DMA translations can produce repeated IOMMU faults, device failure, or memory corruption leading to kernel instability or crash. This supports high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:32:57.238Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/dbd76a537d8cb814e7f5b795ab21ecb7949c821d"
        },
        {
          "url": "https://git.kernel.org/stable/c/20b3c566e2702e5d4d0545be8a97029a2eebcc0e"
        },
        {
          "url": "https://git.kernel.org/stable/c/dae251ff11d2d2208a029f98923756831cefec46"
        },
        {
          "url": "https://git.kernel.org/stable/c/faad224fe0f0857a04ff2eb3c90f0de57f47d0f3"
        }
      ],
      "title": "iommu/amd: Fix clone_alias() to use the original device\u0027s devid",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53053",
    "datePublished": "2026-06-24T16:29:59.093Z",
    "dateReserved": "2026-06-09T07:44:35.381Z",
    "dateUpdated": "2026-08-05T12:32:57.238Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-53053",
      "date": "2026-08-10",
      "epss": "0.00129",
      "percentile": "0.02887"
    },
    "microsoft_vex": {
      "current_release_date": "2026-07-12T15:00:37.000Z",
      "cve": "CVE-2026-53053",
      "id": "msrc_CVE-2026-53053",
      "initial_release_date": "2026-06-02T00:00:00.000Z",
      "product_status:known_affected": "2",
      "product_status:under_investigation": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "iommu/amd: Fix clone_alias() to use the original device\u0027s devid",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-53053.json",
      "version": "4"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-53053\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-06-24T17:17:17.327\",\"lastModified\":\"2026-07-21T17:24:06.203\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\niommu/amd: Fix clone_alias() to use the original device\u0027s devid\\n\\nCurrently clone_alias() assumes first argument (pdev) is always the\\noriginal device pointer. This function is called by\\npci_for_each_dma_alias() which based on topology decides to send\\noriginal or alias device details in first argument.\\n\\nThis meant that the source devid used to look up and copy the DTE\\nmay be incorrect, leading to wrong or stale DTE entries being\\npropagated to alias device.\\n\\nFix this by passing the original pdev as the opaque data argument to\\nboth the direct clone_alias() call and pci_for_each_dma_alias(). Inside\\nclone_alias(), retrieve the original device from data and compute devid\\nfrom it.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/iommu/amd/iommu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3332364e4ebc0581d133a334645a20fd13b580f1\",\"lessThan\":\"dbd76a537d8cb814e7f5b795ab21ecb7949c821d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3332364e4ebc0581d133a334645a20fd13b580f1\",\"lessThan\":\"20b3c566e2702e5d4d0545be8a97029a2eebcc0e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3332364e4ebc0581d133a334645a20fd13b580f1\",\"lessThan\":\"dae251ff11d2d2208a029f98923756831cefec46\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3332364e4ebc0581d133a334645a20fd13b580f1\",\"lessThan\":\"faad224fe0f0857a04ff2eb3c90f0de57f47d0f3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1f03a258f20f1699ede29bb40804074db9398a0d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.4.17\",\"lessThan\":\"5.5\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/iommu/amd/iommu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.5\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.5\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.91\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.33\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.10\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.0,\"impactScore\":6.0}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.4.17\",\"versionEndExcluding\":\"6.12.91\",\"matchCriteriaId\":\"935F22A1-D219-4651-B5B3-37C2DD6E217D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.33\",\"matchCriteriaId\":\"96D99E49-380D-43AB-BDBA-25C3AD018A9C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"7.0.10\",\"matchCriteriaId\":\"A13475D2-59BF-4716-94B5-7C1D239A2CF4\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/20b3c566e2702e5d4d0545be8a97029a2eebcc0e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/dae251ff11d2d2208a029f98923756831cefec46\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/dbd76a537d8cb814e7f5b795ab21ecb7949c821d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/faad224fe0f0857a04ff2eb3c90f0de57f47d0f3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-05T14:36:45+00:00",
      "cve": "CVE-2026-53053",
      "id": "CVE-2026-53053",
      "initial_release_date": "2026-06-24T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: iommu/amd: Fix clone_alias() to use the original device\u0027s devid",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53053.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-07-24T02:19:11Z",
      "cve": "CVE-2026-53053",
      "id": "CVE-2026-53053",
      "initial_release_date": "2026-06-27T01:54:31Z",
      "product_status:first_fixed": "55",
      "product_status:known_affected": "425",
      "product_status:known_not_affected": "79",
      "product_status:recommended": "401",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-53053",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-53053.json",
      "version": "16"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.