Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-06-26T00:00:00 kernel: iommu/vt-d: Avoid NULL pointer dereference or refcount corruption 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CWE-476

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Avoid NULL pointer dereference or refcount corruption Commit 60f030f7418d ("iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE") fixed a NULL pointer dereference in an unlikely situation partly. If dev_pasid is not found in the dev_pasids list, it remains NULL. However, the teardown operations are executed unconditionally, this lead to a NULL pointer dereference or refcount corruption. If the domain was never attached to this IOMMU, info will be NULL, which would cause an immediate dereference when checking --info->refcnt. Even if info is not NULL, decrementing the refcount without having removed a valid PASID might unbalance the count. This could lead to premature dropping of the refcount to 0, potentially causing a use-after-free for the remaining active devices sharing the domain. Fix it by returning early if dev_pasid is NULL, before executing the teardown operations. Issue found by AI review and suggested by Kevin Tian. https://sashiko.dev/#/patchset/20260421031347.1408890-1-zhenzhong.duan%40intel.com

A flaw was found in the Linux kernel's Input-Output Memory Management Unit (IOMMU) virtualized direct memory access (VT-d) component. This vulnerability occurs when the system attempts to perform cleanup operations without a valid device identifier, leading to a null pointer dereference or incorrect management of resource references. An attacker with local access could exploit this to cause a system crash, resulting in a denial of service (DoS).

Moderate impact. A flaw in the Linux kernel's iommu/vt-d subsystem can lead to a NULL pointer dereference or refcount corruption if a device's PASID is not found during teardown operations. This could result in system instability or a use-after-free condition for active devices sharing the IOMMU domain. This issue affects Red Hat Enterprise Linux 9.8.z, 9.9, 10.2.z, 10.3, and Red Hat In-Vehicle OS, while older RHEL versions are not impacted due to the absence of the vulnerable code. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Red Hat Enterprise Linux 10 Affected kernel Red Hat Enterprise Linux 6 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel-rt Red Hat Enterprise Linux 8 Not affected kernel Red Hat Enterprise Linux 8 Not affected kernel-rt Red Hat Enterprise Linux 9 Affected kernel Red Hat Enterprise Linux 9 Affected kernel-rt https://www.cve.org/CVERecord?id=CVE-2026-53281 https://nvd.nist.gov/vuln/detail/CVE-2026-53281 https://lore.kernel.org/linux-cve-announce/2026062615-CVE-2026-53281-bce7@gregkh/T