Linux kernel (drivers/iommu/intel): When the PASID is not found on the device list, VT-d runs the teardown anyway and

CVSS 8.8CVE-2026-53281Kernel, userspace & hypervisorcurated

Impact

When the PASID is not found on the device list, VT-d runs the teardown anyway and decrements a reference count it never took, so the domain's refcount can reach zero while other devices are still attached to it. The IOMMU domain is then freed under live devices - a use-after-free on the translation state of unrelated passthrough devices that share that domain, plus a NULL dereference on the simpler path.

Who can reach it

A tenant detaching or closing a PASID-attached device through /dev/vfio/* plus /dev/iommu drives the teardown; hitting the not-found case takes a detach that races another detach or a domain replacement. Conditional on VT-d scalable mode with PASID in use. The blast radius is other devices sharing the same domain, which is what makes this cross-tenant rather than self-inflicted.

What to do

Update to a stable kernel carrying commits 9022cb9a / cdfe3c9f (the record's fixed-version list predates the fix and is not a usable target). Interim: avoid sharing one IOMMU domain across devices belonging to different tenants, and disable PASID/scalable mode where SVA is not required.

References

https://git.kernel.org/stable/c/9022cb9ac0c2a72a57fa8ebf92ac74f953ca0153 https://git.kernel.org/stable/c/cdfe3c9f2c9e28a8651ee463c88ad191ced2f840 https://nvd.nist.gov/vuln/detail/CVE-2026-53281

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.