Linux kernel (drivers/iommu/riscv): The RISC-V IOMMU driver updated device-directory and process-directory entries

CVSS 8.8CVE-2026-53057Kernel, userspace & hypervisorcurated

Impact

The RISC-V IOMMU driver updated device-directory and process-directory entries without issuing the invalidations the specification requires, so the hardware keeps using cached device and PASID context after the kernel has moved or freed it. A device therefore keeps translating through a context the kernel believes is gone - a stale mapping that survives detach, which is a DMA window into whatever that memory becomes.

Who can reach it

Reached on any domain attach/detach or PASID setup for a device behind a RISC-V IOMMU - a tenant closing or rebinding a passthrough device is enough. Hardware-conditional: this affects RISC-V platforms only and is not reachable on the x86 or Arm nodes that make up essentially all GPU fleets today. Track it only if RISC-V hosts are in the estate.

What to do

Update to a stable kernel carrying commits 3f917d9b / d99d1c13 on RISC-V hosts. No action needed on x86 (VT-d/AMD-Vi) or Arm SMMU nodes.

References

https://git.kernel.org/stable/c/3f917d9bff68600f77561900f3145bd4706dc840 https://git.kernel.org/stable/c/d99d1c13faa793ff1abab0d20ab6473c838081b3 https://nvd.nist.gov/vuln/detail/CVE-2026-53057

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.