Linux Kernel CVE-2026-53281

Upstream fix available (stable commits), released patched version per stable tree metadata; apply your distribution's kernel update that incorporates commits 79ea2feb917b, 9022cb9ac0c2 or cdfe3c9f2c9e (git.kernel.org/stable/c/...), which add an early return when dev_pasid is NULL before any teardown operations. Track and apply the fixed stable releases (the 6.13.x/6.14, and later 6.18.x/7.0.x/7.1 series identified in EUVD) via your vendor's normal kernel package channel. There is no clean feature toggle that disables this code path without disabling IOMMU/PASID functionality, so the primary compensating control is restricting local access: limit which users and containers can perform device/PASID attach-detach operations and reduce exposure of untrusted local workloads on hosts using VT-d with SVA/PASID; the trade-off is that disabling Intel VT-d (intel_iommu=off) or scalable-mode PASID would remove DMA isolation and device-assignment/SVA capabilities, which is generally undesirable on virtualization hosts. Reference the NVD advisory https://nvd.nist.gov/vuln/detail/CVE-2026-53281 for canonical links.