CVE-2026-53053: Linux Kernel Privilege Escalation Flaw

CVE-2026-53053 Overview

CVE-2026-53053 is a Linux kernel vulnerability in the AMD Input-Output Memory Management Unit (IOMMU) driver. The flaw resides in the clone_alias() function, which incorrectly assumes its first argument is always the original PCI device pointer. Because pci_for_each_dma_alias() may pass either the original or the alias device depending on topology, the resulting source device identifier (devid) used to copy the Device Table Entry (DTE) can be wrong. This propagates stale or incorrect DTE entries to alias devices, potentially corrupting Direct Memory Access (DMA) translation state for PCI peripherals managed by the AMD IOMMU.

Critical Impact
Incorrect DTE propagation may lead to faulty DMA translations on alias PCI devices, affecting device isolation and IOMMU-enforced memory protection on AMD systems.

Affected Products

Linux kernel (AMD IOMMU driver, drivers/iommu/amd/)
Systems with AMD platforms using PCI DMA aliases
Linux distributions shipping affected stable kernel branches prior to the fix commits

Discovery Timeline

2026-06-24 - CVE-2026-53053 published to the National Vulnerability Database
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53053

Vulnerability Analysis

The AMD IOMMU driver uses clone_alias() to copy a Device Table Entry from a source device to an alias device. The function previously assumed that the pdev parameter passed in was the original device. In practice, the kernel helper pci_for_each_dma_alias() walks the PCI topology and invokes the callback with either the original device or an intermediate alias, depending on bridges and requester ID rewriting along the path.

Because the source devid was derived from whichever device the callback received, the DTE copy operation could read from an unintended source. This results in alias devices receiving stale or incorrect IOMMU translation state, which undermines the per-device isolation guarantees that the IOMMU is supposed to provide.

Root Cause

The defect is a logic error in argument handling [CWE-670 control flow assumption]. clone_alias() derived devid from the callback-supplied PCI device rather than from the original device that initiated the DMA alias walk. The fix passes the original pdev as the opaque data argument to both the direct clone_alias() call and to pci_for_each_dma_alias(). Inside clone_alias(), the original device is now retrieved from data and used to compute the correct source devid.

Attack Vector

This is a kernel correctness bug rather than a directly weaponizable remote vulnerability. Exploitation requires local presence on an AMD system where PCI devices with DMA aliases are enumerated by the IOMMU subsystem. Impact is limited to incorrect IOMMU state for alias devices, which may produce DMA faults, device malfunction, or weakened isolation between PCI functions sharing alias relationships. No public proof-of-concept exploit is available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified exploitation code is available. Refer to the upstream commits for the precise source-level fix.

Detection Methods for CVE-2026-53053

Indicators of Compromise

Unexpected IOMMU events in dmesg referencing AMD-Vi, including IO_PAGE_FAULT entries tied to alias devices
PCI devices behind bridges reporting DMA errors or device resets after IOMMU initialization
Inconsistent DTE contents observed via kernel debugging interfaces for devices that share a requester ID alias

Detection Strategies

Inventory running kernels and compare against the patched stable branches referenced in the upstream commits 20b3c566, dae251ff, dbd76a53, and faad224f
Review boot logs for AMD IOMMU initialization warnings on systems with multi-function PCI devices and PCIe-to-PCI bridges
Use configuration management tooling to flag AMD hosts running pre-patch kernel builds

Monitoring Recommendations

Forward kernel logs to a centralized logging or SIEM pipeline and alert on AMD-Vi page fault patterns
Track PCI device error counters and IOMMU group membership changes across reboots
Monitor for unexpected device reattachments or driver rebinds that may indicate DMA translation failures

How to Mitigate CVE-2026-53053

Immediate Actions Required

Identify AMD systems running affected Linux kernels and prioritize them for kernel updates
Apply the patched kernel from your Linux distribution once available for your branch
For systems that cannot be patched immediately, restrict physical and local administrative access to limit interaction with affected PCI devices

Patch Information

The issue is fixed in upstream Linux kernel commits available on git.kernel.org. The relevant changes are referenced in Linux Kernel Commit 20b3c566, Linux Kernel Commit dae251ff, Linux Kernel Commit dbd76a53, and Linux Kernel Commit faad224f. The fix updates clone_alias() to use the original device's devid by passing the original pdev through the pci_for_each_dma_alias() opaque data argument.

Workarounds

No documented runtime workaround exists; applying the kernel patch is the supported remediation
Where feasible, avoid attaching untrusted PCI devices to AMD hosts running unpatched kernels
Consider booting with iommu=off or amd_iommu=off only after evaluating the security and functional trade-offs, since disabling the IOMMU removes DMA isolation entirely

bash

# Verify the running kernel version and AMD IOMMU status
uname -r
dmesg | grep -i -E 'AMD-Vi|iommu'

# After patching, reboot and confirm IOMMU initializes cleanly
dmesg | grep -i 'AMD-Vi: Interrupt remapping enabled'