CVE-2026-53280: Linux Kernel IOMMU NULL Pointer Dereference in PCI Reset

Technical summary

CVE-2026-53280 is a null pointer dereference vulnerability in the Linux kernel's IOMMU handling code, specifically in the pci_dev_reset_iommu_done() function. When a default IOMMU domain fails to allocate during the first device probe, the group->domain pointer remains NULL. Subsequently, if a PCI device reset is initiated, pci_dev_reset_iommu_done() attempts to re-attach the device without validating the domain pointer, causing a crash when dereferencing domain->ops->attach_dev through __iommu_attach_device(). The fix involves skipping the re-attach operation when no valid domain exists, while the prepare phase (pci_dev_reset_iommu_prepare()) remains safe as it already handles NULL domain pointers correctly.

Business impact

Systems running affected Linux kernel versions face denial-of-service risk when local users trigger PCI device reset operations on systems where IOMMU domain allocation has previously failed. In production environments using SR-IOV, device passthrough, or aggressive PCI hotplug scenarios, this could result in unexpected kernel crashes, system instability, and service interruptions. The impact is limited to local attackers with sufficient privileges, reducing exposure in multi-tenant or strictly controlled environments.

Affected systems

This vulnerability affects the Linux kernel across multiple versions. It impacts systems utilizing IOMMU technology, particularly those relying on PCI device management features such as single-root I/O virtualization (SR-IOV), device assignment to virtual machines, or dynamic device hotplug. Both bare-metal and virtualized deployments with these features enabled are potentially affected. Verify specific kernel version coverage against the official Linux kernel security advisories and your distribution's patch timeline.

Exploitability

Exploitation requires local system access with user-level privileges (PR:L in CVSS terms) and the ability to trigger PCI device reset operations. The attack vector is local (AV:L) with low complexity (AC:L), meaning no special conditions or race conditions are required—a simple reset operation on an affected device post-probe failure will reliably trigger the crash. No network access, special credentials, or user interaction is necessary once local access is obtained. The vulnerability is not known to be actively exploited in the wild.

Remediation

Patch the Linux kernel to a version that includes the fix for CVE-2026-53280. The remedy adds a validation check in pci_dev_reset_iommu_done() to safely handle cases where group->domain is NULL, preventing the crash without impacting normal IOMMU re-attachment workflows. Coordinate with your Linux distribution vendor for backported patches to supported kernel branches, as upstream fixes may not immediately be available in all maintained versions.

Patch guidance

Monitor your Linux distribution's security advisories and kernel repositories for patches addressing this vulnerability. Check the official CVE tracker, your vendor's security bulletin (Red Hat, Canonical, SUSE, etc.), and the Linux kernel's stable tree for applicable fixes. When patches become available, test them in a non-production environment to ensure compatibility with your IOMMU and PCI device configuration before rolling out to production systems. Verify patch application by confirming the kernel version and changelog entries.

Detection guidance

Monitor system logs and kernel dmesg output for null pointer dereference panics or kernel oops messages originating from pci_dev_reset_iommu_done() or nearby IOMMU code. Correlation with PCI device reset events (hotplug, passthrough reconfiguration, or explicit reset commands) may indicate exploitation attempts. Kernel crash dumps can be analyzed to confirm the crash location. Organizations with SIEM or log aggregation systems should create detection rules for kernel panics involving IOMMU or PCI reset code paths.

Why prioritize this

This vulnerability merits timely patching due to its straightforward exploitability by local users and direct impact on system availability. While severity is moderate (5.5 CVSS), the combination of ease of triggering and guaranteed denial-of-service makes it suitable for near-term remediation cycles. Prioritize systems actively using IOMMU features, SR-IOV, or device passthrough. Systems without IOMMU enabled or those not performing PCI resets can defer patching to standard maintenance windows.

Risk score, explained

The CVSS 3.1 score of 5.5 (MEDIUM) reflects a local attack vector requiring user-level privileges, with zero impact on confidentiality or integrity but high impact on availability. The straightforward exploitation path (low complexity, no special preconditions) and high availability impact from system crashes justify the medium rating. The local-only nature prevents network-based exploitation, which would otherwise elevate the score. Organizations handling mission-critical workloads or those with strict availability requirements may internally risk-rank this higher than the base score suggests.

Frequently asked questions