CVE-2026-43253

A flaw was found in the Linux kernel's IOMMU (Input/Output Memory Management Unit) AMD component. When the system operates under a stressed environment with iommu.strict=1 enabled, a busy-wait operation within the wait_on_sem() function can occur while holding a spinlock with interrupts disabled. This condition leads to increased contention and extended periods where the system cannot process interrupts, resulting in soft lockups. The primary consequence is a Denial of Service (DoS), making the system unresponsive.

A low impact denial of service flaw was found in the AMD IOMMU driver of the Red Hat Enterprise Linux kernel. When a system runs with iommu.strict=1, the completion wait path in iommu_completion_wait() busy-waits in wait_on_sem() while holding a spinlock with interrupts disabled. In a stressed environment this extends the period during which interrupts are disabled and increases lock contention, which can result in soft lockups and an unresponsive system. The flaw is local in nature, requires the system to be configured with iommu.strict=1 and placed under stress to trigger, and impacts availability only; there is no impact to confidentiality or integrity, which is reflected in the low severity rating.

The current Red Hat CVSS base score is 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), which differs from the 7.5 network attack vector score in the upstream CVE record because this kernel locking issue requires local access and is not remotely exploitable.

Red Hat Enterprise Linux 6 and 7 Extended Lifecycle Support and Red Hat In-Vehicle OS 2.0 are not affected because the vulnerable code is not present in those streams. For the affected Red Hat Enterprise Linux 8, 9, and 10 kernel and kernel-rt streams, the fix has been deferred given the low severity and the specific preconditions required to trigger the issue (iommu.strict=1 and a stressed environment); the residual risk is limited to temporary soft lockups causing denial of service on systems running in that configuration.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.