CVE-2026-53281

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

iommu/vt-d: Avoid NULL pointer dereference or refcount corruption

Commit 60f030f7418d ("iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE")

fixed a NULL pointer dereference in an unlikely situation partly.

If dev_pasid is not found in the dev_pasids list, it remains NULL.

However, the teardown operations are executed unconditionally, this lead

to a NULL pointer dereference or refcount corruption.

If the domain was never attached to this IOMMU, info will be NULL, which

would cause an immediate dereference when checking --info->refcnt.

Even if info is not NULL, decrementing the refcount without having removed

a valid PASID might unbalance the count. This could lead to premature

dropping of the refcount to 0, potentially causing a use-after-free for the

remaining active devices sharing the domain.

Fix it by returning early if dev_pasid is NULL, before executing the

teardown operations.

Issue found by AI review and s

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References