Executive brief
A vulnerability in the Linux kernel's AMD IOMMU driver can cause systems to crash during the boot process. This occurs when the system attempts to identify hardware devices that are not properly described in the system's virtualization tables, leading to a memory error. This issue primarily affects the availability of virtual machines and servers using specific AMD-based hardware configurations.
Technical details
An out-of-bounds read exists in the AMD IOMMU driver's __rlookup_amd_iommu() function. The vulnerability is triggered during iommu_device_register() when the kernel probes PCI devices. The function indexes the rlookup_table using a device ID (devid) without performing a bounds check against the table's allocation size. If a PCI device's BDF is not described by the I/O Virtualization Reporting Structure (IVRS), the lookup reads past the end of the kvcalloc-allocated table into adjacent slab memory. This results in the kernel dereferencing invalid pointers, causing a General Protection Fault (GPF) at boot time. The issue was introduced when the table allocation was changed to a tight kvcalloc() and has been fixed by adding explicit bounds checking for devid against pci_seg->last_bdf.
Affected products
- Linux Linux Kernel e874c666b15b to f0a0f01787ec
Timeline
- 2026-04-21: disclosed: Vulnerability reported and patch authored
- 2026-05-11: patched: Patch committed to mainline kernel
- 2026-06-26: advisory: CVE-2026-53283 published