CVE-2026-53053

Awaiting Analysis Awaiting Analysis - Queue

AMD IOMMU Clone Alias Devid Miscalculation Fix

Publication date: 2026-06-24

Last updated on: 2026-07-14

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix clone_alias() to use the original device's devid Currently clone_alias() assumes first argument (pdev) is always the original device pointer. This function is called by pci_for_each_dma_alias() which based on topology decides to send original or alias device details in first argument. This meant that the source devid used to look up and copy the DTE may be incorrect, leading to wrong or stale DTE entries being propagated to alias device. Fix this by passing the original pdev as the opaque data argument to both the direct clone_alias() call and pci_for_each_dma_alias(). Inside clone_alias(), retrieve the original device from data and compute devid from it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-24

Last Modified

2026-07-14

Generated

2026-07-15

AI Q&A

2026-06-24

EPSS Evaluated

2026-07-13

NVD

CVE-2026-53053

EUVD

EUVD-2026-38921

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Impact Analysis

This vulnerability in the Linux kernel's iommu/amd component could lead to incorrect or stale Device Table Entries (DTE) being propagated to alias devices. This happens because the clone_alias() function incorrectly assumes the first argument is always the original device pointer, which may not be true. As a result, device identification and memory mapping could be incorrect, potentially causing device misbehavior or security issues related to device memory access.

Executive Summary

This vulnerability exists in the Linux kernel's iommu/amd component, specifically in the clone_alias() function. The function incorrectly assumes that its first argument is always the original device pointer, but it can sometimes be an alias device pointer. This causes the function to use an incorrect device ID (devid) when looking up and copying the Device Translation Entry (DTE), which can lead to wrong or outdated DTE entries being assigned to alias devices.

The issue arises because clone_alias() is called by pci_for_each_dma_alias(), which decides whether to send the original or alias device details based on topology. The fix involves passing the original device pointer explicitly as opaque data to clone_alias() and pci_for_each_dma_alias(), ensuring the correct device ID is used.

Hi! I’m here to help you understand CVE-2026-53053. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70