Skip to main content

Linux Kernel CVE-2026-53281

| EUVDEUVD-2026-39886 HIGH
NULL Pointer Dereference (CWE-476)
2026-06-26 Linux GHSA-p9cf-q2gf-35mq
Denial Of Service Linux Null Pointer Dereference
8.8
CVSS 3.1 · Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Obtain local low-privileged access
  2. Delivery
    Invoke IOMMU/PASID detach on unattached domain
  3. Exploit
    dev_pasid lookup returns NULL
  4. Execution
    Teardown dereferences NULL or underflows refcount
  5. Persist
    Kernel panic or use-after-free
  6. Impact
    Denial of service or potential privilege escalation

Vulnerability Assessment

Weakness
CWE
CWE-476
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires local access with PR:L (authenticated, low privilege per the CVSS vector) on a host running the Intel VT-d IOMMU driver with PASID/dev_pasid teardown reachable - i.e., VT-d enabled and the attacker able to invoke an IOMMU domain detach/PASID-removal path for a domain that was never attached to that IOMMU (dev_pasid not present in the dev_pasids list). Key limiting factors: the bug is explicitly described as an 'unlikely situation,' implying a narrow race window that raises practical attack complexity; it is local-only (AV:L, no remote/network reach and no UI required); it is specific to Intel VT-d-equipped systems with the affected kernel commit range; and reliably converting the NULL deref/refcount imbalance into more than a crash is non-trivial. Default behavior on an affected, VT-d-enabled host is exploitable for DoS by a local low-privileged actor able to reach the PASID teardown code.
Impact

Signals conflict and should be reconciled before prioritization. The supplied CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, base 8.8) implies easy local exploitation with full confidentiality, integrity and availability loss and a scope change, but the description characterizes the bug as an 'unlikely situation' race during teardown and the tag is Denial of Service - suggesting the realistic dominant impact is a kernel crash, with use-after-free-driven escalation being plausible but conditional, not guaranteed. That tension argues the real-world attack complexity is higher than AC:L suggests. EPSS is low (0.17%, 6th percentile), there is no CISA KEV listing, and no public exploit is identified, so this is not evidence of active or widespread exploitation. Net: a genuine memory-safety defect in a ubiquitous component that merits patching in normal kernel update cycles, but not an emergency relative to its 8.8 score, because triggering requires local low-privileged access plus winning an unlikely race, and weaponization to full compromise is unproven.
Exploit ScenarioDerived

A local low-privileged user or a constrained workload that can drive device/PASID detach operations repeatedly races the IOMMU teardown path against a domain that was never attached to that IOMMU, causing a NULL pointer dereference that panics the host or, by unbalancing the refcount, frees a structure still in use by other devices sharing the domain. The immediate, reliable outcome is a kernel crash (denial of service); the use-after-free could in principle be groomed toward privilege escalation, but no public exploit or proof-of-concept is identified at time of analysis.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 28, 2026

Local privilege escalation or denial of service in the Linux kernel's Intel VT-d IOMMU driver (iommu/vt-d) arises from incomplete handling of a missing dev_pasid entry during PASID teardown; an authenticated low-privileged actor able to drive IOMMU/PASID detach operations can trigger a NULL pointer dereference or unbalanced refcount that may decay into a use-after-free. This completes an earlier partial fix (commit 60f030f7418d) and is tagged as Denial of Service. There is no public exploit identified at time of analysis, and EPSS exploitation probability is low at 0.17% (6th percentile).

RemediationAI

Upstream fix available (stable commits), released patched version per stable tree metadata; apply your distribution's kernel update that incorporates commits 79ea2feb917b, 9022cb9ac0c2 or cdfe3c9f2c9e (git.kernel.org/stable/c/...), which add an early return when dev_pasid is NULL before any teardown operations. Track and apply the fixed stable releases (the 6.13.x/6.14, and later 6.18.x/7.0.x/7.1 series identified in EUVD) via your vendor's normal kernel package channel. There is no clean feature toggle that disables this code path without disabling IOMMU/PASID functionality, so the primary compensating control is restricting local access: limit which users and containers can perform device/PASID attach-detach operations and reduce exposure of untrusted local workloads on hosts using VT-d with SVA/PASID; the trade-off is that disabling Intel VT-d (intel_iommu=off) or scalable-mode PASID would remove DMA isolation and device-assignment/SVA capabilities, which is generally undesirable on virtualization hosts. Reference the NVD advisory https://nvd.nist.gov/vuln/detail/CVE-2026-53281 for canonical links.

Affected VersionsENISA

Linux 6.13.3 <6.14
Linux 60f030f7418d3f1d94f2fb207fe3080e1844630b <79ea2feb917b05366b49d85573c9c5331f043b2c
Linux patch: 7.1
Linux 60f030f7418d3f1d94f2fb207fe3080e1844630b <9022cb9ac0c2a72a57fa8ebf92ac74f953ca0153
Linux 60f030f7418d3f1d94f2fb207fe3080e1844630b <cdfe3c9f2c9e28a8651ee463c88ad191ced2f840
Linux df96876be3b064aefc493f760e0639765d13ed0d
Linux patch: 7.0.10
Linux 6.14
Linux patch: 0
Linux 6.12.57 <6.13
Linux patch: 6.18.33
Linux 68ec78beb4a3fb0877cbaaf49758c85410c05977

Affected Packages

euvd linux fix: 6.13, 6.14

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The flaw lives in the kernel's Intel Virtualization Technology for Directed I/O (VT-d) IOMMU subsystem, which manages DMA remapping and PASID (Process Address Space ID) bindings between devices and IOMMU domains. During teardown, the code searches the dev_pasids list for a matching dev_pasid; if none is found it remains NULL, yet the teardown path previously executed unconditionally. When the domain was never attached to that IOMMU, the associated info pointer is NULL, so the info->refcnt check dereferences NULL; even when info is non-NULL, decrementing the refcount without having removed a valid PASID unbalances the count and can prematurely drop it to zero, producing a use-after-free for other active devices sharing the domain. The root-cause classes are CWE-476 (NULL Pointer Dereference) and CWE-416 (Use After Free), though the input lists CWE as N/A. CPE coverage is the generic cpe:2.3:a:linux:linux:*, i.e. the mainline/stable kernel rather than a specific distribution.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 8.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
vuln.today AI 5.8 MEDIUM

Local low-privileged trigger (AV:L/PR:L) of an explicitly unlikely race (AC:H); reliable impact is a kernel crash (A:H) with only conditional UAF-driven C/I exposure (C:L/I:L).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat 5.5 MEDIUM

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Jun 28, 2026 - 08:22 NVD
8.8 (HIGH)
Patch available
Jun 26, 2026 - 21:02 EUVD
CVE Published
Jun 26, 2026 - 19:40 cve.org
HIGH 8.8
CVE Published
Jun 26, 2026 - 19:40 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

iommu/vt-d: Avoid NULL pointer dereference or refcount corruption

Commit 60f030f7418d ("iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE") fixed a NULL pointer dereference in an unlikely situation partly.

If dev_pasid is not found in the dev_pasids list, it remains NULL. However, the teardown operations are executed unconditionally, this lead to a NULL pointer dereference or refcount corruption.

If the domain was never attached to this IOMMU, info will be NULL, which would cause an immediate dereference when checking --info->refcnt.

Even if info is not NULL, decrementing the refcount without having removed a valid PASID might unbalance the count. This could lead to premature dropping of the refcount to 0, potentially causing a use-after-free for the remaining active devices sharing the domain.

Fix it by returning early if dev_pasid is NULL, before executing the teardown operations.

Issue found by AI review and suggested by Kevin Tian. https://sashiko.dev/#/patchset/20260421031347.1408890-1-zhenzhong.duan%40intel.com

Executive ViewAI

Why It Matters

CVE-2026-53281 affects the Linux kernel's Intel VT-d IOMMU driver and enables authenticated users to escalate privileges or trigger system denial of service with a CVSS rating of 8.8. However, real-world exploitation probability is extremely low (0.2% EPSS), no active exploitation has been identified, and the attack requires existing system access, making this a manageable remediation priority for organizations operating virtualization infrastructure or systems with multi-user access.

Business Impact: Medium
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 94% exploitable
Prevalence
Ubiquitous
Linux kernel; Intel VT-d driver present across vast majority of x86 deployments
Vendor Action
See Below
Not affected (vendor confirmed)
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
Medium

Priority Score

44
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +44
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Null Pointer Dereference MEDIUM

A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2020-1967 HIGH POC
7.5
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2021-3449 MEDIUM
5.9
CVE-2015-3194 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.168 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.149 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.197 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.145 Affected
Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard Image SLES15-SP7-HPC-Azure Affected
Image SLES15-SP7-BYOS-Azure Image SLES15-SP7-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-EC2 Image SLES15-SP7-EC2-ECS-HVM Image SLES15-SP7-GCE Image SLES15-SP7-HPC-BYOS-Azure Image SLES15-SP7-HPC-BYOS-EC2 Image SLES15-SP7-HPC-BYOS-GCE Image SLES15-SP7-Hardened-BYOS-Azure Image SLES15-SP7-Hardened-BYOS-EC2 Image SLES15-SP7-Hardened-BYOS-GCE Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE Affected
Image SLES15-SP7-SAP-Azure Image SLES15-SP7-SAP-Azure-3P Image SLES15-SP7-SAP-BYOS-Azure Image SLES15-SP7-SAP-BYOS-EC2 Image SLES15-SP7-SAP-BYOS-GCE Image SLES15-SP7-SAP-EC2 Image SLES15-SP7-SAP-GCE Image SLES15-SP7-SAP-Hardened-Azure Image SLES15-SP7-SAP-Hardened-BYOS-Azure Image SLES15-SP7-SAP-Hardened-BYOS-EC2 Image SLES15-SP7-SAP-Hardened-BYOS-GCE Image SLES15-SP7-SAP-Hardened-GCE Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-53281 ADVISORY https://ubuntu.com/security/notices/USN-8566-1 ADVISORY https://ubuntu.com/security/notices/USN-8568-1 ADVISORY https://vuldb.com/vuln/374357 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22511/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22512/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22521/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22522/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22665/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22666/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22699/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22742/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22769/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2799/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2800/ REF https://access.redhat.com/errata/RHSA-2026:47017 REF https://access.redhat.com/errata/RHSA-2026:47040 REF https://access.redhat.com/security/cve/CVE-2026-53281 REF https://bugzilla.redhat.com/show_bug.cgi?id=2493728 REF https://git.kernel.org/stable/c/79ea2feb917b05366b49d85573c9c5331f043b2c REF https://git.kernel.org/stable/c/9022cb9ac0c2a72a57fa8ebf92ac74f953ca0153 REF https://git.kernel.org/stable/c/cdfe3c9f2c9e28a8651ee463c88ad191ced2f840 REF https://git.kernel.org/stable/c/d1a677f9c5e02c4ae49614044ac21296660d1391 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53281.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy