Skip to main content

Linux Kernel EUVDEUVD-2026-38921

| CVE-2026-53053 HIGH
Incorrect Conversion between Numeric Types (CWE-681)
2026-06-24 Linux GHSA-8m6r-f5m5-x7p9
Information Disclosure Linux Amd
8.8
CVSS 3.1 · Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain low-privileged local access on AMD host
  2. Delivery
    Operate device behind aliasing PCI bridge
  3. Exploit
    Trigger DMA-alias DTE clone path
  4. Execution
    Inherit stale/incorrect Device Table Entry
  5. Persist
    DMA crosses domain isolation
  6. Impact
    Disclose or corrupt other-device memory

Vulnerability Assessment

Weakness
CWE
CWE-681
Exploitation Conditions

Exploitation requires an AMD platform with the AMD-Vi IOMMU active and a PCI topology that causes pci_for_each_dma_alias() to enumerate an alias Requester ID (e.g., devices behind a PCIe-to-PCI bridge or certain multifunction/quirked devices), so clone_alias() receives the alias device and copies the wrong DTE. The attacker must be local with at least low privileges (CVSS PR:L) and able to initiate DMA from the relevant device; no user interaction is needed (UI:N). Limiting factors that reduce real-world risk: it does not affect Intel/other IOMMUs, does not apply to systems without the aliasing topology, requires local access rather than network reach (AV:L), and depends on hardware/PCI layout that is not present in many default deployments-making opportunistic, widespread exploitation unlikely.
Impact

Signals are mixed and lean lower than the headline CVSS 8.8 suggests. The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) is a local, low-privilege attack with a scope change and high confidentiality/integrity/availability impact-consistent with a DMA-isolation weakness where one device's mapping bleeds into another (hence S:C and the 'Information Disclosure' tag). However, EPSS is only 0.17% (6th percentile) and the vulnerability is NOT on the CISA KEV list, indicating no observed widespread exploitation. There is no SSVC decision data and no CWE in the input. Real-world exploitation is constrained: it requires specific hardware (AMD IOMMU) and a PCI topology that triggers DMA aliasing, plus the ability to drive DMA from a relevant device-so this is far harder to weaponize than the local 'PR:L' metric implies. Note the conflict: the CVSS scores C:H/I:H/A:H, but the source tags describe only 'Information Disclosure'; the practical impact may be narrower (incorrect/stale isolation) than full integrity/availability compromise-verify against the upstream commits. Treat as a correctness/isolation hardening fix to schedule in normal kernel patch cycles rather than an emergency.
Exploit ScenarioDerived

On an AMD server with the IOMMU enabled, a low-privileged local actor who can drive DMA from a device sitting behind a PCIe-to-PCI bridge (or otherwise aliased) benefits from the alias device inheriting an incorrect/stale DTE, so its DMA is translated under the wrong domain and may reach memory or mappings belonging to another device or domain-undermining isolation and potentially disclosing data. No public exploit is identified at time of analysis, and triggering requires the specific aliasing topology rather than a generic code path.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 28, 2026

Improper DMA-alias handling in the Linux kernel's AMD IOMMU driver lets a stale or incorrect Device Table Entry (DTE) be propagated to an alias PCI device, weakening the DMA isolation the IOMMU is meant to enforce. The flaw affects systems on AMD platforms where pci_for_each_dma_alias() supplies an alias-rather than the original-device to clone_alias(), causing the wrong source devid to be used when copying the DTE. EPSS is low (0.17%, 6th percentile) and there is no public exploit identified at time of analysis.

RemediationAI

Apply the stable kernel update that contains the fix for your branch: Vendor-released patch versions 6.12.91, 6.18.33, 7.0.10, or 7.1 (and equivalent distribution kernels carrying the backported commits). The fix corresponds to git.kernel.org stable commits dbd76a537d8cb814e7f5b795ab21ecb7949c821d, dae251ff11d2d2208a029f98923756831cefec46, 20b3c566e2702e5d4d0545be8a97029a2eebcc0e, and faad224fe0f0857a04ff2eb3c90f0de57f47d0f3 referenced from https://nvd.nist.gov/vuln/detail/CVE-2026-53053. Track your distribution's security advisory and install its corresponding kernel build, then reboot. As this is a kernel DMA-isolation correctness fix there is no clean userspace workaround; if patching must be deferred, compensating controls are limited to reducing exposure to untrusted DMA-capable devices-physically restrict access to PCIe/Thunderbolt/hot-plug slots and disable external DMA ports in firmware (trade-off: loss of those expansion/peripheral capabilities)-and avoid passing through or hot-plugging devices behind PCI bridges that trigger DMA aliasing in multi-tenant or VFIO scenarios (trade-off: constrains virtualization device-passthrough use).

Affected VersionsENISA

Linux patch: 6.18.33
Linux 5.4.17 <5.5
Linux 1f03a258f20f1699ede29bb40804074db9398a0d
Linux patch: 7.0.10
Linux 3332364e4ebc0581d133a334645a20fd13b580f1 <dbd76a537d8cb814e7f5b795ab21ecb7949c821d
Linux patch: 0
Linux 3332364e4ebc0581d133a334645a20fd13b580f1 <dae251ff11d2d2208a029f98923756831cefec46
Linux patch: 6.12.91
Linux 3332364e4ebc0581d133a334645a20fd13b580f1 <20b3c566e2702e5d4d0545be8a97029a2eebcc0e
Linux patch: 7.1
Linux 5.5
Linux 3332364e4ebc0581d133a334645a20fd13b580f1 <faad224fe0f0857a04ff2eb3c90f0de57f47d0f3

Affected Packages

euvd linux fix: 5.5

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The affected component is the AMD IOMMU (AMD-Vi) driver in the Linux kernel, which programs per-device Device Table Entries (DTEs) to govern DMA remapping and isolation. For devices that issue DMA under an aliased Requester ID (common with PCIe-to-PCI bridges and certain multifunction topologies), the kernel walks aliases via pci_for_each_dma_alias() and clones the DTE so the alias inherits the original device's translation/domain mapping. The bug is that clone_alias() assumed its first argument was always the original device, but the iterator passes either the original or an alias depending on topology; deriving the source devid from that argument therefore yields the wrong table index. The class of defect is incorrect resource/index identification leading to a stale or mismatched security-relevant mapping (CWE is listed as N/A by the source, but this aligns with use of incorrect/stale configuration data). The fix passes the original pdev as the opaque data argument to both the direct call and the iterator, and recomputes devid from it.

Know when Amd gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 8.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
vuln.today AI 7.7 HIGH

Local low-priv access (AV:L/PR:L); AC:H because it needs a specific AMD IOMMU aliasing topology; S:C and C/I:H reflect cross-device DMA isolation loss, A:L as availability impact is secondary.

3.1 AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L
SUSE 7.0 HIGH
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat 7.0 MEDIUM

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Jun 28, 2026 - 08:22 NVD
8.8 (HIGH)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:29 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 24, 2026 - 16:29 cve.org
HIGH 8.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

iommu/amd: Fix clone_alias() to use the original device's devid

Currently clone_alias() assumes first argument (pdev) is always the original device pointer. This function is called by pci_for_each_dma_alias() which based on topology decides to send original or alias device details in first argument.

This meant that the source devid used to look up and copy the DTE may be incorrect, leading to wrong or stale DTE entries being propagated to alias device.

Fix this by passing the original pdev as the opaque data argument to both the direct clone_alias() call and pci_for_each_dma_alias(). Inside clone_alias(), retrieve the original device from data and compute devid from it.

Executive ViewAI

Why It Matters

A vulnerability in the Linux kernel's AMD IOMMU driver (CVE-2026-53053) can weaken DMA isolation protections on affected systems, potentially allowing unauthorized memory access across device boundaries. Organizations operating Linux infrastructure on AMD platforms should prioritize patching to maintain the hardware-enforced isolation that protects guest workloads and sensitive data. While no public exploit has been identified, the HIGH severity rating reflects significant impact if this vulnerability is exploited.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 94% exploitable
Prevalence
Ubiquitous
Linux kernel runs on a vast fraction of servers and AMD systems
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

44
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +44
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Amd

View all
CVE-2021-22986 CRITICAL POC
9.8 Mar 31

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.
CVE-2026-46174 HIGH POC
8.8 May 28

Local privilege escalation and information disclosure in the Linux kernel on AMD Zen2 CPUs allows low-privileged users t
CVE-2020-6103 CRITICAL POC
9.9 Jul 20

An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.
CVE-2020-6102 CRITICAL POC
9.9 Jul 20

An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.
CVE-2020-6101 CRITICAL POC
9.9 Jul 20

An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.
CVE-2020-6100 CRITICAL POC
9.9 Jul 20

An exploitable memory corruption vulnerability exists in AMD atidxx64.dll 26.20.15019.19000 graphics driver. Rated criti
CVE-2018-6546 CRITICAL POC
9.8 Apr 13

plays_service.exe in the plays.tv service before 1.27.7.0, as distributed in AMD driver-installation packages and Gaming
CVE-2021-3653 HIGH POC
8.8 Sep 29

A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. Rated high severity (CVSS 8.8), this vu
CVE-2020-12138 HIGH POC
8.8 Apr 27

AMD ATI atillk64.sys 5.11.9.0 allows low-privileged users to interact directly with physical memory by calling one of se
CVE-2019-5098 HIGH POC
8.6 Dec 05

An exploitable out-of-bounds read vulnerability exists in AMD ATIDXX64.DLL driver, version 26.20.13001.29010. Rated high
CVE-2015-7724 HIGH POC
7.8 Jun 07

AMD fglrx-driver before 15.9 allows local users to gain privileges via a symlink attack. Rated high severity (CVSS 7.8),
CVE-2015-7723 HIGH POC
7.8 Jun 07

AMD fglrx-driver before 15.7 allows local users to gain privileges via a symlink attack. Rated high severity (CVSS 7.8),

Same weakness CWE-681 – Incorrect Conversion between Numeric Types

View all
CVE-2017-7308 HIGH POC
7.8
CVE-2016-3074 CRITICAL POC
9.8
CVE-2021-38187 CRITICAL POC
9.8
CVE-2022-34169 HIGH POC
7.5
CVE-2021-27219 HIGH POC
7.5
CVE-2022-27882 HIGH POC
7.5
CVE-2020-6582 HIGH POC
7.5
CVE-2019-16200 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Important
Product Status
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.168 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.149 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.197 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.145 Affected
Container suse/sle-micro-rancher/5.3:latest Container suse/sle-micro-rancher/5.4:5.4.4.5.149 Affected
Container suse/sle-micro/base-5.5:2.0.4-5.8.296 Affected
Container suse/sle-micro/kvm-5.5:2.0.4-3.5.570 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-53053 ADVISORY https://ubuntu.com/security/notices/USN-8566-1 ADVISORY https://ubuntu.com/security/notices/USN-8568-1 ADVISORY https://vuldb.com/vuln/373390 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22511/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22512/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22521/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22522/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22665/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22666/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22699/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22742/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22769/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2799/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2800/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2840/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2841/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3044/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3089/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3156/ REF https://git.kernel.org/stable/c/166a08644aa509e5d27e154d7fa774f4181df9e0 REF https://git.kernel.org/stable/c/20b3c566e2702e5d4d0545be8a97029a2eebcc0e REF https://git.kernel.org/stable/c/880a2e6c887c8f51870c0a00dfba3c8519178b65 REF https://git.kernel.org/stable/c/dae251ff11d2d2208a029f98923756831cefec46 REF https://git.kernel.org/stable/c/dbd76a537d8cb814e7f5b795ab21ecb7949c821d REF https://git.kernel.org/stable/c/faad224fe0f0857a04ff2eb3c90f0de57f47d0f3

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy