CVE-2026-53164 Overview
CVE-2026-53164 affects the Linux kernel's IOMMU DMA subsystem. The flaw resides in iommu_dma_iova_link_swiotlb(), which processes unaligned mappings in three segments: head, middle, and trailer. When the middle segment is empty due to a lack of aligned pages, the function invokes iommu_map() with a zero size. The iommupt implementation rejects this as illegal and triggers a faulty error unwind that begins from the wrong offset. The result is mapping corruption and a WARN_ON during eventual teardown. The condition is frequently triggered by Thunderbolt NVMe drives that force SWIOTLB use for unaligned memory, particularly when smartctl issues passthrough commands with oddly aligned buffers.
Critical Impact
A local user with access to affected NVMe hardware can trigger kernel mapping corruption and a WARN_ON, leading to system instability and potential denial of service.
Affected Products
- Linux kernel versions containing the iommu_dma_iova_link_swiotlb() SWIOTLB integration path
- Systems using IOMMU with forced SWIOTLB bounce buffering
- Hosts with Thunderbolt-attached NVMe devices issuing unaligned passthrough I/O
Discovery Timeline
- 2026-06-25 - CVE CVE-2026-53164 published to NVD
- 2026-06-25 - Last updated in NVD database
Technical Details for CVE-2026-53164
Vulnerability Analysis
The vulnerability is a kernel-side logic flaw in the DMA-IOMMU integration code that handles bounce-buffered (SWIOTLB) mappings. The function iommu_dma_iova_link_swiotlb() splits an unaligned DMA mapping into three regions to satisfy IOMMU page-alignment requirements. The head and trailer cover unaligned edges, while the middle covers fully aligned pages mapped directly via iommu_map().
When the buffer is small or aligned in such a way that no full pages exist between the head and trailer, the middle region has zero length. The current code still calls iommu_map() with size = 0. The iommupt backend treats this as an illegal request and returns an error. The caller then enters an error unwind path that uses an incorrect starting offset, leaving partial mappings in inconsistent state. When the DMA mapping is later destroyed, the kernel detects the corruption and emits a WARN_ON, indicating broken state in IOVA accounting.
Root Cause
The root cause is a missing zero-length guard in iommu_dma_iova_link_swiotlb(). The function does not check whether the middle aligned region is empty before calling iommu_map(), and its error unwind logic uses 0 rather than the correct offset as the starting point for cleanup, corrupting the mapping state.
Attack Vector
Triggering the condition requires local I/O activity that produces unaligned DMA buffers routed through SWIOTLB under an active IOMMU. The reporter notes consistent reproduction using Thunderbolt NVMe drives in combination with smartctl passthrough commands. Any workload that issues similarly aligned passthrough I/O on affected hardware can reach the faulty code path and induce kernel state corruption.
No public exploit code is available. The vulnerability presents as a stability and reliability issue rather than a remote attack surface. See the upstream fixes for technical details: Kernel Patch Commit 6ec91df, Kernel Patch Commit ab61c99, and Kernel Patch Commit b16f8d4.
Detection Methods for CVE-2026-53164
Indicators of Compromise
- Kernel log entries containing WARN_ON traces originating from IOMMU DMA teardown paths.
- Repeated iommu_map() failure messages referencing zero-length or illegal size arguments.
- System instability correlated with Thunderbolt NVMe attach events or smartctl passthrough usage.
Detection Strategies
- Monitor dmesg and journalctl -k for warnings referencing iommu_dma_iova_link_swiotlb or iommupt.
- Correlate kernel warnings with NVMe passthrough activity, such as nvme ioctls issued by smartctl.
- Track kernel version and patch level across the fleet to identify hosts running pre-fix builds with IOMMU and SWIOTLB enabled.
Monitoring Recommendations
- Forward kernel logs to a centralized SIEM and alert on IOMMU WARN_ON patterns.
- Establish a baseline for DMA mapping warnings to detect anomalous spikes.
- Inventory hosts that combine Thunderbolt NVMe storage with IOMMU-enforced bounce buffering for prioritized patching.
How to Mitigate CVE-2026-53164
Immediate Actions Required
- Apply the upstream Linux kernel fix referenced in the patch commits and rebuild or update affected kernels.
- Prioritize endpoints and servers using Thunderbolt NVMe storage with IOMMU enabled.
- Reboot patched systems to load the corrected kernel and clear any lingering corrupted IOVA state.
Patch Information
The upstream fix adds an explicit zero-length check before calling iommu_map() and corrects the error-unwind starting offset so cleanup begins at the proper position rather than at 0. The fix is published in three stable-tree commits: Kernel Patch Commit 6ec91df, Kernel Patch Commit ab61c99, and Kernel Patch Commit b16f8d4. Distribution maintainers should pull these patches into their stable kernel branches.
Workarounds
- Avoid running smartctl passthrough commands against Thunderbolt-attached NVMe drives on unpatched kernels.
- Where feasible, disable forced SWIOTLB usage or detach Thunderbolt NVMe devices until the kernel is updated.
- Restrict local user access to NVMe ioctl interfaces by enforcing strict permissions on /dev/nvme* device nodes.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
