Linux kernel (drivers/iommu): An unaligned DMA mapping with no aligned middle section calls into the mapper with length

CVSS 5.9CVE-2026-53164Kernel, userspace & hypervisorcurated

Impact

An unaligned DMA mapping with no aligned middle section calls into the mapper with length zero, which the newer page-table backend rejects; the error unwind then starts from the wrong offset and unlinks the wrong range, leaving the mapping corrupted. Parts of an IOVA range stay mapped after the mapping is supposed to be torn down, so a device retains a working DMA window into pages the kernel has already released.

Who can reach it

Driven by unaligned I/O buffers on a device forced through SWIOTLB bouncing. Upstream sees it from NVMe passthrough commands (smartctl) on drives behind forced-bounce paths - and tenants in a GPU cluster do hold /dev/nvme* and can issue passthrough commands with arbitrary buffer alignment. Conditional on forced SWIOTLB being in play (untrusted device, sub-page IOVA granule, or a bounce-forcing config); a node with no bouncing never takes this path.

What to do

The record lists no fixed release; boot a kernel carrying the stable fix commits below. Interim controls: do not expose raw NVMe passthrough (/dev/nvme* admin/IO passthrough ioctls) to tenants, and avoid configurations that force SWIOTLB bouncing for tenant-facing devices.

References

https://git.kernel.org/stable/c/ab61c990a87d084f5565ee70340543e3a5394697 https://git.kernel.org/stable/c/b16f8d40bac9ced838d24c9842707af9ecae92e2 https://nvd.nist.gov/vuln/detail/CVE-2026-53164

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.