CVE-2026-53053

iommu/amd: Fix clone_alias() to use the original device's devid

HIGH
8.8
CVSS Score
Published: June 24, 2026 at 04:29 PM UTC
Updated: October 30, 2026 at 01:19 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
HIGH8.8
Exploit prediction
EPSS 0.1%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix clone_alias() to use the original device's devid Currently clone_alias() assumes first argument (pdev) is always the original device pointer. This function is called by pci_for_each_dma_alias() which based on topology decides to send original or alias device details in first argument. This meant that the source devid used to look up and copy the DTE may be incorrect, leading to wrong or stale DTE entries being propagated to alias device. Fix this by passing the original pdev as the opaque data argument to both the direct clone_alias() call and pci_for_each_dma_alias(). Inside clone_alias(), retrieve the original device from data and compute devid from it.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

5.4.17 ≤ v < 6.12.916.13 ≤ v < 6.18.336.19 ≤ v < 7.0.101f03a258f20f1699ede29bb40804074db9398a0d3332364e4ebc0581d133a334645a20fd13b580f15.4.175.5
Vendor states this is fixed in 20b3c566e2702e5d4d0545be8a97029a2eebcc0e (fixed)
Vendor states this is fixed in dae251ff11d2d2208a029f98923756831cefec46 (fixed)
Vendor states this is fixed in dbd76a537d8cb814e7f5b795ab21ecb7949c821d (fixed)
Vendor states this is fixed in faad224fe0f0857a04ff2eb3c90f0de57f47d0f3 (fixed)
Vendor states this is fixed in 5.5 (unaffected)
Vendor states this is fixed in 6.12.91 (unaffected)
Vendor states this is fixed in 6.18.33 (unaffected)
Vendor states this is fixed in 6.6.160 (unaffected)
Vendor states this is fixed in 7.0.10 (unaffected)
Vendor states this is fixed in 7.1 (unaffected)

SSVC — Action Prioritization

SSVCNo known exploitNot automatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

8.8HIGHLinux
Vector?

Quick Info

StatusMODIFIED
CWE
NVD-CWE-noinfoCWE-681

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card