Linux kernel (drivers/iommu/amd): On AMD hosts the Device Table Entry copied to a DMA-alias device is looked up using

CVSS 8.8CVE-2026-53053Kernel, userspace & hypervisorcurated

Impact

On AMD hosts the Device Table Entry copied to a DMA-alias device is looked up using the wrong source device ID, so an alias can be programmed with another device's - or a stale - translation table. The aliased function then DMAs through an IOMMU domain that does not belong to it, which is exactly the cross-tenant DMA the IOMMU is there to prevent.

Who can reach it

No tenant action is required - the wrong Device Table Entry is installed when the device is set up. It bites on any AMD-Vi host where a passed-through function has a PCI DMA alias: devices behind PCIe-to-PCI bridges and multi-function endpoints covered by alias quirks, which includes a lot of real GPU and NIC topologies. From then on the tenant's device translates through the wrong domain.

What to do

Update to a stable kernel carrying commits dbd76a53 / 20b3c566 (the CNA's fixed-version field on this record is not a usable target - confirm the commits in your distro kernel). Interim: audit which passthrough devices have DMA aliases (check the IOMMU group membership against the PCI topology) and avoid handing out aliased functions to tenants until patched.

References

https://git.kernel.org/stable/c/dbd76a537d8cb814e7f5b795ab21ecb7949c821d https://git.kernel.org/stable/c/20b3c566e2702e5d4d0545be8a97029a2eebcc0e https://nvd.nist.gov/vuln/detail/CVE-2026-53053

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.