CVE-2026-53281: Linux VT-d IOMMU NULL Pointer Dereference and Refcount Corruption

Technical summary

CVE-2026-53281 is a NULL pointer dereference and refcount corruption vulnerability in the Linux kernel's iommu/vt-d subsystem. The issue occurs in PASID (Process Address Space ID) lifecycle management when a dev_pasid structure cannot be found in the dev_pasids list during detachment. Prior mitigation (commit 60f030f7418d) was incomplete: it warned but did not prevent unconditional execution of teardown operations. If dev_pasid lookup fails and returns NULL, the code proceeds to decrement info->refcnt without validation, causing either immediate NULL dereference or refcount underflow. If the domain was never attached to the specific IOMMU instance, info itself is NULL, guaranteeing a crash on dereference. Even when info is valid, premature refcount decrementation can unbalance reference counts, leading to use-after-free conditions for other active devices sharing the same domain. The fix requires an early return if dev_pasid is NULL, preventing execution of teardown logic on invalid state.

Business impact

This vulnerability affects system stability and multi-tenant security on Linux systems using Intel VT-d IOMMU for device virtualization or privileged isolation. A local attacker (non-root user) can trigger a kernel panic, causing denial of service across all workloads on the system. In virtualized environments, a guest operating system with unprivileged user access could crash the host kernel, affecting all co-located tenants. The memory corruption aspects create potential for privilege escalation or information disclosure, depending on the kernel's memory safety hardening posture. Organizations relying on Linux with VT-d for container orchestration, hypervisor deployments, or high-availability systems should prioritize patching.

Affected systems

The vulnerability affects all Linux kernel versions implementing the iommu/vt-d subsystem with PASID support. Based on the patchset metadata, mainline and stable kernel series containing the affected code are impacted. Systems relying on Intel IOMMU hardware features (common in data centers, cloud platforms, and enterprise virtualization) are at risk. Embedded systems and IoT devices without VT-d support or PASID configuration are unaffected. The vulnerability requires local access to the affected system; remote exploitation is not possible.

Exploitability

Exploitability is moderate to high. An attacker requires local access and unprivileged user-level code execution—a capability present in multi-user systems, containers, and VMs. No special credentials, kernel module loading, or IOMMU-specific knowledge is required; the vulnerability can be triggered through normal PASID attach/detach sequences via IOMMU-aware user-space libraries or through specific system call patterns. The crash is deterministic and reliable. However, the kernel must be compiled with IOMMU VT-d and PASID support enabled, which is not universal across all Linux distributions or configurations. Weaponized exploit code would be straightforward to develop but requires targeting specific kernel versions and configurations.

Remediation

Remediation requires updating to a Linux kernel version that includes the fix for this vulnerability. The fix is a logical safeguard: adding an early return in the PASID detachment path if dev_pasid is NULL, preventing execution of teardown operations on invalid state. This is a minimal, non-invasive patch. Organizations should apply patches to their kernel baseline and redeploy or reboot systems. For systems unable to update immediately, restricting local user access or disabling VT-d IOMMU features (if not required) reduces exposure, though these are temporary measures. Verify patch application by checking kernel version logs and testing IOMMU-dependent workloads post-deployment.

Patch guidance

Obtain patches from your Linux distribution's security advisory or the upstream Linux kernel repository. Verify against the vendor advisory from the distribution (Red Hat, Ubuntu, Debian, SUSE, etc.) to confirm the patch version and applicability to your kernel series. The upstream fix is in the patchset referenced: https://sashiko.dev/#/patchset/20260421031347.1408890-1-zhenzhong.duan%40intel.com. Test patches in a non-production environment first, particularly on systems with IOMMU workloads (VMs, containers, GPU passthrough). Schedule reboots to activate kernel updates during maintenance windows. For LTS (Long-Term Support) kernels, patches may lag upstream; check your distribution's security tracking portal for ETA.

Detection guidance

Monitor kernel logs for IOMMU-related panics or warnings (dmesg | grep -i iommu, dmesg | grep -i vt-d). Look for NULL pointer dereference backtraces involving functions in drivers/iommu/intel-svm.c or related PASID handling code. Capture kernel version from uname -r and cross-reference against published CVE advisories. Systems using IOMMU passthrough for VMs or containers may log detachment warnings; correlate timing with application restarts or VM lifecycle events. Performance monitoring tools may detect unexpected system restarts or uptime gaps following IOMMU operations. No user-space indicators are directly observable; detection is kernel-centric.

Why prioritize this

This vulnerability merits HIGH priority for organizations operating Linux on Intel platforms with IOMMU enabled. The combination of reliable local exploitability, HIGH CVSS score (8.8), and potential for both denial of service and memory corruption makes it a critical patch target. Virtualization platforms, Kubernetes clusters, and multi-tenant systems should prioritize patching within 1-2 weeks. Systems not using VT-d or PASID features can be deprioritized, but verification of actual kernel configuration is essential before deferral. The lack of KEV/CISA inclusion does not diminish risk; it reflects recent disclosure rather than coordinated exploitation.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects: Attack Vector (Local)—no network path, but users with shell access can trigger the flaw; Attack Complexity (Low)—no race conditions or special timing required; Privileges Required (Low)—standard user account suffices; User Interaction (None)—fully automated; Scope (Changed)—the IOMMU impact can affect other processes and domains sharing the same hardware resource; Confidentiality (High)—memory corruption can leak kernel memory; Integrity (High)—refcount corruption allows uncontrolled memory operations; Availability (High)—denial of service via kernel panic is immediate. The score appropriately captures the severity for systems where local privilege escalation and container escape are consequential threats.

Frequently asked questions