🔴 高危 | CVE-2026-53281 — In the Linux kernel, the following vulnerability has be
🔴 《高危安全漏洞：CVE-2026-53281》
CVSS 评分: 高危（8.8） CVE ID: CVE-2026-53281
漏洞描述
In the Linux kernel, the following vulnerability has been resolved:
iommu/vt-d: Avoid NULL pointer dereference or refcount corruption
Commit 60f030f7418d ("iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE")
fixed a NULL pointer dereference in an unlikely situation partly.
If dev_pasid is not found in the dev_pasids list, it remains NULL.
However, the teardown operations are executed unconditionally, this lead
to a NULL pointer dereference or refcount corruption.
If the domain was never attached to this IOMMU, info will be NULL, which
would cause an immediate dereference when checking --info->refcnt.
Even if info is not NULL, decrementing the refcount without having removed
a valid PASID might unbalance the count. This could lead to premature
dropping of the refcount to 0, potentially causing a use-after-free for the
remaining active devices sharing the domain.
Fix it by returning early if dev_pasid is NULL, before executing the
teardown operations.
Issue found by AI review and suggested by Kevin Tian.
https://sashiko.dev/#/patchset/20260421031347.1408890-1-zhenzhong.duan%40intel.com
| 字段 | 值 |
|---|---|
| CVE ID | CVE-2026-53281 |
| CVSS 评分 | 8.8 |
| 严重程度 | 高危 |
| 发布时间 | 2026-06-26 |
| 状态 | Received |
数据来源: NVD | 获取时间: 2026-06-28 18:15