CVE-2026-52953

A flaw was found in the Linux kernel's input/output memory management unit (IOMMU) virtualized directed I/O (VT-d) subsystem. This vulnerability occurs due to an out-of-scope memory access when a QEMU process is terminated. An attacker could potentially trigger a general protection fault, leading to a kernel oops and causing a denial of service (DoS) on the affected system.

This flaw is rated Moderate rather than Important because exploitation requires local access with elevated privileges to terminate or manage virtual machines utilizing PCI device assignment. The issue only manifests on hosts equipped with Intel processors where VT-d and nested Process Address Space ID (PASID) support are actively utilized by VFIO. While terminating an affected guest process can trigger an out-of-bounds memory dereference and result in a host kernel crash, the vulnerability cannot be exploited remotely or on systems not using direct hardware passthrough.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.