CVE-2026-53053

A flaw was found in the Linux kernel's IOMMU (Input/Output Memory Management Unit) AMD driver. The clone_alias() function incorrectly uses the device ID (devid) when handling alias devices. This can lead to the propagation of wrong or stale Device Table Entry (DTE) entries to alias devices, potentially impacting system stability or data integrity.

An AMD IOMMU alias handling logic bug can clone a device table entry from the wrong PCI device when pci_for_each_dma_alias supplies an alias device as the callback argument. This can propagate wrong or stale DTE state to DMA aliases and may weaken DMA isolation for affected PCI topologies. For the CVSS the PR:L reflects the paranoid case where a local actor controls a VM, service account, or delegated device management path that can exercise an affected DMA capable PCI device. The issue is not network reachable. Impact is not a normal kernel NULL dereference DoS. It may include denial of service through DMA faults and in the worst defensible case confidentiality or integrity impact if stale IOMMU mappings permit unintended DMA access.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.