CVE-2026-53281: Linux Kernel Use-After-Free Vulnerability

CVE-2026-53281 Overview

CVE-2026-53281 is a Linux kernel vulnerability in the Intel VT-d (iommu/vt-d) subsystem. The flaw allows a NULL pointer dereference or reference count corruption when dev_pasid is not found in the dev_pasids list during teardown. The prior fix in commit 60f030f7418d addressed the issue only partially, leaving teardown operations to execute unconditionally.

The defect can cause an immediate kernel dereference when info is NULL, or unbalance the refcount when a valid PASID has not been removed. Premature refcount decrement to zero can lead to a use-after-free affecting active devices sharing the domain.

Critical Impact
Local attackers with low privileges can trigger kernel memory corruption, potentially escalating to arbitrary code execution in kernel context on affected Linux systems with Intel VT-d enabled.

Affected Products

Linux kernel builds containing the Intel VT-d IOMMU driver (drivers/iommu/intel/)
Distributions tracking the affected upstream commits, including Red Hat Enterprise Linux (per Red Hat Bug #2493728)
Systems using PASID (Process Address Space ID) with SVA/shared virtual addressing on Intel platforms

Discovery Timeline

2026-06-26 - CVE-2026-53281 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-53281

Vulnerability Analysis

The vulnerability resides in the Intel VT-d IOMMU driver's PASID teardown path. The Linux kernel maintains a dev_pasids list tracking device-PASID bindings for a given IOMMU domain. During detach operations, the driver searches this list for a matching dev_pasid entry.

A prior patch, commit 60f030f7418d ("iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE"), attempted to guard against a NULL result but did not stop the teardown flow. When the lookup fails, dev_pasid remains NULL yet the code proceeds to execute cleanup logic, including access to info->refcnt.

The issue was identified through AI-assisted code review and suggested by Kevin Tian.

Root Cause

The root cause is missing early-return logic after a failed list lookup. If the domain was never attached to the IOMMU, info is NULL and --info->refcnt triggers an immediate NULL pointer dereference. When info is non-NULL but no valid PASID was removed, decrementing the refcount unbalances the count. This unbalanced state can drop the refcount to zero prematurely, creating a use-after-free window for other devices still referencing the domain.

Attack Vector

Exploitation requires local access with low privileges on a system using Intel VT-d IOMMU with PASID-based device assignment. An attacker manipulates device attach and detach sequences to trigger the teardown path with a missing dev_pasid entry. The resulting NULL dereference produces a kernel oops and denial of service, while the refcount imbalance path can lead to use-after-free conditions in kernel memory. The scope-change component of the vulnerability indicates impact beyond the initial component boundary.

No public proof-of-concept exploit is available for CVE-2026-53281 at this time.

Detection Methods for CVE-2026-53281

Indicators of Compromise

Kernel oops or panic entries in dmesg referencing intel_iommu, intel_pasid, or PASID detach functions
WARN_ON_ONCE traces originating from VT-d IOMMU teardown paths
Unexpected process termination or kernel instability on systems using SVA or PASID-enabled devices

Detection Strategies

Audit installed kernel versions against upstream fix commits 79ea2feb917b, 9022cb9ac0c2, and cdfe3c9f2c9e
Monitor kernel ring buffer for VT-d IOMMU warnings correlated with device hotplug or PASID lifecycle events
Correlate crash telemetry with workloads using shared virtual addressing on Intel platforms

Monitoring Recommendations

Ingest /var/log/messages and journalctl -k output into centralized logging for kernel fault analysis
Track vendor advisories from Red Hat and other Linux distributions for backported fixes
Baseline expected IOMMU-related kernel messages to detect anomalous frequency of PASID teardown warnings

How to Mitigate CVE-2026-53281

Immediate Actions Required

Apply distribution kernel updates that incorporate the upstream fix commits
Inventory hosts with Intel VT-d enabled and PASID-capable workloads for prioritized patching
Restrict local access on multi-tenant systems until patches are deployed

Patch Information

The upstream Linux kernel fix returns early when dev_pasid is NULL, before executing teardown operations. The fix is present in commits 79ea2feb917b, 9022cb9ac0c2, and cdfe3c9f2c9e. Refer to the Red Hat CVE-2026-53281 advisory and Red Hat Bug #2493728 for distribution-specific backports.

Workarounds

Disable Intel VT-d in BIOS or via kernel parameter intel_iommu=off where IOMMU functionality is not required
Avoid PASID-based device assignment and shared virtual addressing on unpatched systems
Limit which local users can trigger device attach and detach operations through group and namespace controls

bash

# Verify current kernel version and IOMMU status
uname -r
dmesg | grep -i "DMAR\|IOMMU"

# Temporary mitigation via GRUB kernel parameter
# Edit /etc/default/grub and append to GRUB_CMDLINE_LINUX:
#   intel_iommu=off
sudo grub2-mkconfig -o /boot/grub2/grub.cfg
sudo reboot