CVE-2026-52953: Linux Kernel VT-d IOMMU Out-of-Bounds Access Vulnerability

Technical summary

CVE-2026-52953 is an out-of-bounds access vulnerability in the iommu/vt-d subsystem of the Linux kernel. The vulnerability occurs in the domain_remove_dev_pasid() function when handling a global static blocked domain—a dummy domain object lacking a corresponding dmar_domain structure. During device PASID (Process Address Space ID) teardown, the code attempts to dereference fields beyond the legitimate iommu_domain structure, triggering a general protection fault on non-canonical memory addresses. The crash path is triggered by VFIO device unbinding and PCI function-level reset operations that invoke intel_nested_set_dev_pasid(), which calls domain_remove_dev_pasid() without proper boundary checking for the blocked domain special case.

Business impact

Systems running affected Linux kernel versions face potential denial of service when terminating QEMU-based virtual machines or performing device assignment/reset operations. In environments using KVM/QEMU for virtualization, guest shutdown can unexpectedly crash the hypervisor host. This risk is most acute for data centers, cloud platforms, and organizations heavily reliant on Linux-based virtualization. The crash may corrupt running workloads or require manual system recovery. The impact is localized to environments actively using VT-d device assignment; standard workloads without passthrough device configurations are unaffected.

Affected systems

The vulnerability affects Linux kernel installations with VT-d IOMMU support enabled and VFIO device assignment in use. Primary affected scenarios include KVM/QEMU hypervisor hosts performing virtual device passthrough, particularly when guests are shut down or devices are reset. Specific kernel versions are not enumerated in the source data; however, the fix was resolved upstream, so distributions with recent kernel updates are patched. Verify your kernel version against the vendor advisory to determine exposure.

Exploitability

Exploitation requires local access to the affected system and the ability to trigger VFIO device unbinding or QEMU process termination—actions typically available to privileged users or VM administrators. The vulnerability cannot be exploited remotely. Triggering the crash is straightforward for an authenticated local attacker with appropriate permissions, but the impact is limited to denial of service rather than privilege escalation or data theft. The kernel maintains CVSS 3.1 score of 7.1 (HIGH) due to the requirement for local/privileged access coupled with the availability impact.

Remediation

Apply kernel patches addressing the iommu/vt-d domain handling. The fix follows the pattern already implemented for identity domain handling: return early from domain_remove_dev_pasid() when processing the blocked domain, preventing out-of-bounds memory access. Update to a patched kernel version supplied by your Linux distribution. Verify the specific patch version and kernel build against your vendor's security advisory. For organizations unable to patch immediately, restrict VFIO device assignment and KVM device passthrough until updates are deployed.

Patch guidance

Consult your Linux distribution's (Red Hat, Ubuntu, Debian, SUSE, etc.) security advisories for patched kernel versions. The upstream Linux kernel fix has been merged; distributions backport kernel security patches at different rates. Check your vendor's kernel release notes and apply the latest stable kernel update for your distribution and architecture. Verify that the patch addresses domain_remove_dev_pasid() early-return logic for blocked domain handling. Test patches in a staging environment before production deployment, especially if VT-d device assignment is in use.

Detection guidance

Monitor system logs for general protection faults and kernel oops messages, particularly in syslog or kernel messages coinciding with QEMU shutdown or VFIO device unbind operations. Stack traces containing domain_remove_dev_pasid() or intel_nested_set_dev_pasid() in the call chain indicate exposure. Systems without VT-d enabled or without VFIO device assignment features in use are not at risk and do not require monitoring. Runtime detection is reactive; proactive kernel updates remain the primary mitigation.

Why prioritize this

Assign HIGH priority to patching in any environment running KVM/QEMU with VT-d device passthrough or SR-IOV configurations. Prioritize patching on hypervisor hosts before guest systems. Organizations without device assignment enabled can deprioritize relative to other kernel vulnerabilities, but should still patch as part of regular security maintenance. The local-only attack vector and denial-of-service impact make this less urgent than remote code execution flaws, but the operational severity in virtualized environments elevates its relative risk.

Risk score, explained

The CVSS 3.1 score of 7.1 reflects a HIGH-severity vulnerability with local attack vector (AV:L), low attack complexity (AC:L), and low privilege requirement (PR:L). The vector indicates no impact to confidentiality (C:N) but high impact to integrity and availability (I:H, A:H). The kernel panic and system instability cause direct availability damage. The local/privileged access requirement substantially lowers the score compared to remotely exploitable flaws; however, the high availability and integrity impact within scope elevates it to HIGH severity.

Frequently asked questions