CVE-2026-53372: Linux Kernel Privilege Escalation Flaw

CVE-2026-53372 Overview

CVE-2026-53372 is a Linux kernel vulnerability in the Intel VT-d IOMMU (Input-Output Memory Management Unit) driver. The flaw affects PASID (Process Address Space Identifier) attachment to nested domains configured with dirty tracking. The kernel lacks dirty tracking support on nested domains attached to a PASID. When a nesting parent domain has dirty tracking enabled and a PASID is attached to a nested domain, dirty pages can be lost. Upstream maintainers resolved the issue by failing the attachment early when the nesting parent domain is dirty-tracking configured.

Critical Impact
Loss of dirty page tracking data during VM live migration or checkpoint operations, potentially causing memory state corruption in virtualized workloads that rely on Intel VT-d nested translation.

Affected Products

Linux kernel versions containing the Intel VT-d IOMMU nested domain PASID attachment code path
Systems using Intel VT-d hardware with nested translation enabled
Virtualization hosts leveraging IOMMU dirty tracking for live migration

Discovery Timeline

2026-07-19 - CVE-2026-53372 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-53372

Vulnerability Analysis

The Intel VT-d IOMMU driver supports nested translation, where a guest-managed page table (nested domain) is stacked on top of a host-managed parent domain. Dirty tracking allows the hypervisor to record which pages have been written, a capability essential for live migration and checkpoint/restore workflows.

The kernel implementation does not propagate dirty page tracking through PASID-attached nested domains. When a PASID is attached to a nested domain whose parent has dirty tracking enabled, writes performed through that PASID bypass the dirty tracking mechanism. The hypervisor loses visibility into modified pages, resulting in silent data inconsistency after migration or snapshot restoration.

Root Cause

The root cause is a missing capability check in the PASID attachment code path within the iommu/vt-d driver. The driver permitted attaching a PASID to a nested domain without verifying whether the parent domain had dirty tracking enabled. Because nested domains do not implement dirty page reporting for PASID-scoped translations, any modifications performed through that PASID are not recorded in the dirty bitmap.

Attack Vector

This is a kernel correctness defect rather than a directly exploitable memory safety bug. The impact surfaces in virtualization workflows where a privileged host component configures dirty tracking on a parent IOMMU domain and then attaches a PASID to a nested domain under it. During live migration, the destination host receives an incomplete view of guest memory, which can lead to guest instability, application-level data corruption, or crashes after migration.

The fix, applied in commits 3ea9ce7, 9009c1a, and cc5bd89, blocks the attachment early and returns an error when the caller attempts to attach a PASID to a nested domain whose parent has dirty tracking configured. See the Kernel Git Commit 3ea9ce7 for the reference fix.

Detection Methods for CVE-2026-53372

Indicators of Compromise

Guest VM instability, application crashes, or filesystem inconsistencies observed immediately after live migration between Intel VT-d hosts
Kernel log entries related to intel_iommu PASID attachment on nested domains where dirty tracking is enabled on the parent
Discrepancies between source and destination dirty bitmaps during migration validation

Detection Strategies

Inventory Linux kernel versions across virtualization hosts and compare against the fixed stable branches referenced in the upstream commits
Audit hypervisor configurations that combine Intel VT-d nested translation, PASID assignment, and IOMMU dirty tracking
Monitor dmesg output for VT-d driver messages emitted during PASID attach operations on dirty-tracking-enabled parent domains

Monitoring Recommendations

Track kernel package versions and patch levels on all IOMMU-enabled hosts using centralized configuration management
Correlate live migration events with post-migration guest health metrics to identify silent memory corruption
Alert on unexpected -EINVAL or attachment failure return codes from IOMMU userspace interfaces (/dev/iommu, VFIO)

How to Mitigate CVE-2026-53372

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by commits 3ea9ce7, 9009c1a, and cc5bd89 to all affected virtualization hosts
Update to a distribution kernel that includes these stable backports before performing live migration of PASID-using guests
Disable IOMMU dirty tracking on parent domains where PASID attachment to nested domains is required until the patch is deployed

Patch Information

The fix is committed to the upstream Linux kernel tree. Refer to Kernel Git Commit 3ea9ce7, Kernel Git Commit 9009c1a, and Kernel Git Commit cc5bd89 for the exact source changes. Distribution vendors typically backport these changes into their stable kernel branches; consult vendor advisories for specific package versions.

Workarounds

Avoid enabling IOMMU dirty tracking on nesting parent domains when PASID attachment to nested domains is required for the workload
Perform live migrations only between hosts running patched kernels to prevent silent dirty page loss
Where feasible, use non-nested IOMMU domains for PASID-based device assignment until affected hosts are patched

bash

# Verify running kernel version and check whether the fix is present
uname -r
git -C /path/to/linux log --oneline | grep -E "3ea9ce7|9009c1a|cc5bd89"