CVE-2026-53372: iommu/vt-d: Block PASID attachment to nested domain with dirty tracking
In the Linux kernel, the following vulnerability has been resolved:
iommu/vt-d: Block PASID attachment to nested domain with dirty tracking
Kernel lacks dirty tracking support on nested domain attached to PASID, fails the attachment early if nesting parent domain is dirty tracking configured, otherwise dirty pages would be lost.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Apply the IOMMU VT-d fix described as: block PASID attachment to a nested domain when the nesting parent domain has dirty tracking enabled (fails the attachment early if nesting parent domain is dirty tracking).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53372?
CVE-2026-53372 has a severity rating of 26.
How do I fix CVE-2026-53372?
To fix CVE-2026-53372, update your Linux kernel to the latest patched version.
What is the impact of CVE-2026-53372?
CVE-2026-53372 can lead to improper handling of PASID attachment in nested domains with dirty tracking.
Which versions of Linux Kernel are affected by CVE-2026-53372?
CVE-2026-53372 affects specific versions of the Linux kernel that do not support dirty tracking for nested domains.
Is CVE-2026-53372 a local or remote vulnerability?
CVE-2026-53372 is considered a local vulnerability, as it involves kernel-level operations.