{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-52953", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-06-09T07:44:35.372Z", "datePublished": "2026-06-24T16:28:36.110Z", "dateUpdated": "2026-08-05T12:32:03.109Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:32:03.109Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: Fix oops due to out of scope access\n\nBelow oops triggers when kill QEMU process:\n\n Oops: general protection fault, probably for non-canonical address 0x7fffffff844eaaa7: 0000 [#1] SMP NOPTI\n Call Trace:\n <TASK>\n do_raw_spin_lock+0xaa/0xc0\n _raw_spin_lock_irqsave+0x21/0x40\n domain_remove_dev_pasid+0x52/0x160\n intel_nested_set_dev_pasid+0x1b9/0x1e0\n __iommu_set_group_pasid+0x56/0x120\n pci_dev_reset_iommu_done+0xe3/0x180\n pcie_flr+0x65/0x160\n __pci_reset_function_locked+0x5b/0x120\n vfio_pci_core_close_device+0x63/0xe0 [vfio_pci_core]\n vfio_df_close+0x4f/0xa0\n vfio_df_unbind_iommufd+0x2d/0x60\n vfio_device_fops_release+0x3e/0x40\n __fput+0xe5/0x2c0\n task_work_run+0x58/0xa0\n do_exit+0x2c8/0x600\n do_group_exit+0x2f/0xa0\n get_signal+0x863/0x8c0\n arch_do_signal_or_restart+0x24/0x100\n exit_to_user_mode_loop+0x87/0x380\n do_syscall_64+0x2ff/0x11e0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nThe global static blocked domain is a dummy domain without corresponding\ndmar_domain structure, accessing beyond iommu_domain structure triggers\noops easily. Fix it by return early in domain_remove_dev_pasid() like\nidentity domain."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "baseScore": 7.1, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable path is reached from local VFIO/iommufd device operations, such as a QEMU process closing or resetting an assigned PCI device with PASID state. It is not reachable by unauthenticated network traffic.\nAC:L - Once an Intel VT-d system with a PASID/ATS-capable VFIO PCI device is available, the trigger is deterministic: attach a PASID domain and close or reset the device. No race or condition outside attacker control is required.\nPR:L - The attacker needs local permission to open and operate the VFIO device and iommufd, but the relevant ioctls do not require real root after device access is granted. This is low privilege rather than unauthenticated access.\nUI:N - The attacker can trigger the bug by their own process closing/exiting or issuing device reset operations. No separate victim action is required.\nS:U - The impact is within the host kernel/IOMMU management context and does not demonstrate an IOMMU bypass or VM escape. Standard local kernel impact remains unchanged scope.\nC:N - The bug is an invalid out-of-object access that oopses in the spinlock path, with no data returned to the attacker. There is no demonstrated information disclosure primitive.\nI:H - The bad cast treats the static blocked domain as a larger Intel dmar_domain and performs spinlock/list-related accesses beyond the real object. This is kernel memory corruption, so under the higher-severity rule integrity impact is High.\nA:H - The commit documents a general protection fault/oops during QEMU teardown. A local attacker with VFIO device access can crash the kernel, causing high availability impact."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/iommu/intel/iommu.c"], "versions": [{"version": "7d0c9da6c1509664d96488042bacc02308ca33b2", "lessThan": "88397fad7914ee74a7880fa5ce01f9eb6bfe0743", "status": "affected", "versionType": "git"}, {"version": "7d0c9da6c1509664d96488042bacc02308ca33b2", "lessThan": "1e659db468476733d217c1314c1e0d9244356d6c", "status": "affected", "versionType": "git"}, {"version": "7d0c9da6c1509664d96488042bacc02308ca33b2", "lessThan": "a6dea58d8625c06b9654c0555f101742481335c3", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/iommu/intel/iommu.c"], "versions": [{"version": "6.6", "status": "affected"}, {"version": "0", "lessThan": "6.6", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.33", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.10", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.18.33"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "7.0.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/88397fad7914ee74a7880fa5ce01f9eb6bfe0743"}, {"url": "https://git.kernel.org/stable/c/1e659db468476733d217c1314c1e0d9244356d6c"}, {"url": "https://git.kernel.org/stable/c/a6dea58d8625c06b9654c0555f101742481335c3"}], "title": "iommu/vt-d: Fix oops due to out of scope access", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{}

{"bugzilla": {"description": "kernel: iommu/vt-d: Fix oops due to out of scope access", "id": "2492320", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492320"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["In the Linux kernel, the following vulnerability has been resolved:\niommu/vt-d: Fix oops due to out of scope access\nBelow oops triggers when kill QEMU process:\nOops: general protection fault, probably for non-canonical address 0x7fffffff844eaaa7: 0000 [#1] SMP NOPTI\nCall Trace:\n<TASK>\ndo_raw_spin_lock+0xaa/0xc0\n_raw_spin_lock_irqsave+0x21/0x40\ndomain_remove_dev_pasid+0x52/0x160\nintel_nested_set_dev_pasid+0x1b9/0x1e0\n__iommu_set_group_pasid+0x56/0x120\npci_dev_reset_iommu_done+0xe3/0x180\npcie_flr+0x65/0x160\n__pci_reset_function_locked+0x5b/0x120\nvfio_pci_core_close_device+0x63/0xe0 [vfio_pci_core]\nvfio_df_close+0x4f/0xa0\nvfio_df_unbind_iommufd+0x2d/0x60\nvfio_device_fops_release+0x3e/0x40\n__fput+0xe5/0x2c0\ntask_work_run+0x58/0xa0\ndo_exit+0x2c8/0x600\ndo_group_exit+0x2f/0xa0\nget_signal+0x863/0x8c0\narch_do_signal_or_restart+0x24/0x100\nexit_to_user_mode_loop+0x87/0x380\ndo_syscall_64+0x2ff/0x11e0\nentry_SYSCALL_64_after_hwframe+0x76/0x7e\nThe global static blocked domain is a dummy domain without corresponding\ndmar_domain structure, accessing beyond iommu_domain structure triggers\noops easily. Fix it by return early in domain_remove_dev_pasid() like\nidentity domain.", "A flaw was found in the Linux kernel's input/output memory management unit (IOMMU) virtualized directed I/O (VT-d) subsystem. This vulnerability occurs due to an out-of-scope memory access when a QEMU process is terminated. An attacker could potentially trigger a general protection fault, leading to a kernel oops and causing a denial of service (DoS) on the affected system."], "name": "CVE-2026-52953", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-06-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-52953\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-52953\nhttps://lore.kernel.org/linux-cve-announce/2026062434-CVE-2026-52953-69a6@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7d0c9da6c1509664d96488042bacc02308ca33b2,88397fad7914ee74a7880fa5ce01f9eb6bfe0743)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7d0c9da6c1509664d96488042bacc02308ca33b2,1e659db468476733d217c1314c1e0d9244356d6c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7d0c9da6c1509664d96488042bacc02308ca33b2,a6dea58d8625c06b9654c0555f101742481335c3)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.6"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.6)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.33,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.10,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-06-24T18:30:06.421464+00:00", "updated": "2026-06-28T14:00:21.060284+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}