CVE-2026-53283

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

iommu/amd: Bounds-check devid in __rlookup_amd_iommu()

iommu_device_register() walks every device on the PCI bus via

bus_for_each_dev() and calls amd_iommu_probe_device() for each. The

inlined check_device() path computes the device's sbdf, calls

rlookup_amd_iommu() to find the owning IOMMU, and only afterwards

verifies devid <= pci_seg->last_bdf. __rlookup_amd_iommu() indexes

rlookup_table[devid] with no bounds check of its own, so for a PCI

device whose BDF is not described by the IVRS, the lookup reads past

the end of the allocation before the caller's bounds check can run.

This was harmless before commit e874c666b15b ("iommu/amd: Change

rlookup, irq_lookup, and alias to use kvalloc()"): the table was a

zeroed page-order allocation, so the over-read returned NULL and the

caller's NULL check skipped the device. After that commit the table is

a tight kvcalloc() and the over-read returns adjacent slab contents,

whic

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References