CVE-2026-53281: iommu/vt-d: Avoid NULL pointer dereference or refcount corruption
In the Linux kernel, the following vulnerability has been resolved:
iommu/vt-d: Avoid NULL pointer dereference or refcount corruption
Commit 60f030f7418d ("iommu/vt-d: Avoid use of NULL after WARNONONCE") fixed a NULL pointer dereference in an unlikely situation partly.
If devpasid is not found in the devpasids list, it remains NULL. However, the teardown operations are executed unconditionally, this lead to a NULL pointer dereference or refcount corruption.
If the domain was never attached to this IOMMU, info will be NULL, which would cause an immediate dereference when checking --info->refcnt.
Even if info is not NULL, decrementing the refcount without having removed a valid PASID might unbalance the count. This could lead to premature dropping of the refcount to 0, potentially causing a use-after-free for the remaining active devices sharing the domain.
Fix it by returning early if devpasid is NULL, before executing the teardown operations.
Issue found by AI review and suggested by Kevin Tian. https://sashiko.dev/#/patchset/20260421031347.1408890-1-zhenzhong.duan%40intel.com
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel (iommu/vt-d)to a version that resolves this vulnerability.Patch 60f030f7418d - Upgrade
Upgrade
Linux kernel (iommu/vt-d)to a version that resolves this vulnerability.Patch iommu/vt-d: Avoid NULL pointer dereference or refcount corruption
Event History
Frequently Asked Questions
What level of access is required to exploit this issue?
The CVSS vector indicates local access and low privileges are required. No user interaction is required.
Which systems are most relevant for triage?
Systems using the Linux kernel VT-d IOMMU code are relevant, particularly where domains and device PASIDs are being detached or torn down. A domain that was never attached to the IOMMU can cause an immediate NULL dereference in this path.
What is the potential impact beyond a kernel crash?
An invalid teardown can corrupt a reference count even when the IOMMU domain information is present. This may prematurely free a shared domain and create a use-after-free condition for other active devices using that domain.