CVE-2026-53057 Overview
CVE-2026-53057 affects the Linux kernel RISC-V Input-Output Memory Management Unit (IOMMU) driver. The driver omitted required Translation Lookaside Buffer (TLB) and context cache invalidations after updating Device Directory Table (DDT) or Process Directory Table (PDT) entries. The RISC-V IOMMU specification (Sections 6.3.1 and 6.3.2) mandates these invalidations to keep address-translation caches consistent. The upstream fix introduces riscv_iommu_iodir_iotinval() to issue the IOTINVAL commands after directory entry updates.
Critical Impact
Stale IOMMU translation entries can allow Direct Memory Access (DMA) operations to reference outdated mappings, undermining device isolation on affected RISC-V systems.
Affected Products
- Linux kernel RISC-V IOMMU driver (drivers/iommu/riscv/)
- Linux distributions running on RISC-V hardware with IOMMU enabled
- Kernel branches prior to the commits referenced in stable git
Discovery Timeline
- 2026-06-24 - CVE-2026-53057 published to the National Vulnerability Database (NVD)
- 2026-06-24 - Last updated in NVD database
Technical Details for CVE-2026-53057
Vulnerability Analysis
The RISC-V IOMMU driver maintains the DDT and PDT, which map device and process identifiers to translation contexts. When the kernel modified these directory entries, it did not issue the IOTINVAL commands that flush the IOMMU's internal caches.
The RISC-V IOMMU architecture caches DDT and PDT lookups to accelerate DMA address translation. Without explicit invalidation after directory updates, the IOMMU may continue serving translations from cached entries that no longer match memory state. The patch adds riscv_iommu_iodir_iotinval() to perform the required IOTINVAL.DDT and IOTINVAL.PDT operations.
Root Cause
The root cause is a specification compliance gap in the RISC-V IOMMU driver. Sections 6.3.1 and 6.3.2 of the RISC-V IOMMU specification require software to invalidate cached directory entries after any update. The driver updated directory memory without issuing the corresponding invalidation commands, leaving the IOMMU cache state out of sync with the directory tables.
Attack Vector
The attack surface depends on RISC-V hardware availability and kernel configuration. The vulnerability operates at the kernel level and concerns DMA isolation guarantees. Scenarios where DDT or PDT entries change, such as device attach, detach, or PASID reassignment, can leave stale cached translations. A device or workload could then perform DMA against memory regions whose mappings have been revoked or remapped.
No verified exploitation code is available. The fix is published in the upstream Linux stable tree under commits 3f917d9bff68, d99d1c13faa7, and f5c262b54497.
Detection Methods for CVE-2026-53057
Indicators of Compromise
- No specific runtime Indicators of Compromise (IOCs) have been published for this kernel vulnerability.
- Unexpected DMA faults, IOMMU page faults, or device isolation errors logged by dmesg on RISC-V systems may indicate stale translation cache behavior.
Detection Strategies
- Inventory RISC-V Linux hosts and identify kernels lacking commits 3f917d9bff68, d99d1c13faa7, or f5c262b54497.
- Compare running kernel versions against distribution security advisories that reference CVE-2026-53057.
- Audit kernel configuration for CONFIG_RISCV_IOMMU to determine exposure on each host.
Monitoring Recommendations
- Forward kernel logs to a centralized logging or Security Information and Event Management (SIEM) platform and alert on repeated IOMMU fault messages.
- Track stable kernel updates on RISC-V build targets and confirm the IOTINVAL fix is included in deployed images.
- Monitor vendor advisories from RISC-V distribution maintainers for backports addressing CVE-2026-53057.
How to Mitigate CVE-2026-53057
Immediate Actions Required
- Identify all RISC-V systems running Linux with IOMMU support enabled.
- Apply the upstream stable kernel update containing riscv_iommu_iodir_iotinval() once available from your distribution.
- Restrict untrusted DMA-capable device attachment on affected hosts until the patch is deployed.
Patch Information
The fix is committed to the Linux stable tree. Reference commits: 3f917d9bff68, d99d1c13faa7, and f5c262b54497. Rebuild affected kernels with these commits applied or install distribution-provided updates that incorporate them.
Workarounds
- Disable the RISC-V IOMMU driver where feasible if device isolation requirements allow operation without it.
- Limit hot-plug of DMA-capable peripherals on RISC-V hosts pending patch deployment.
- Maintain strict physical and administrative control over RISC-V hardware until kernels are updated.
# Verify running kernel version on a RISC-V host
uname -r
# Check whether the RISC-V IOMMU driver is loaded
dmesg | grep -i riscv_iommu
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
