CVE-2026-53281

A flaw was found in the Linux kernel's Input-Output Memory Management Unit (IOMMU) virtualized direct memory access (VT-d) component. This vulnerability occurs when the system attempts to perform cleanup operations without a valid device identifier, leading to a null pointer dereference or incorrect management of resource references. An attacker with local access could exploit this to cause a system crash, resulting in a denial of service (DoS).

Moderate impact. A flaw in the Linux kernel's iommu/vt-d subsystem can lead to a NULL pointer dereference or refcount corruption if a device's PASID is not found during teardown operations. This could result in system instability or a use-after-free condition for active devices sharing the IOMMU domain. This issue affects Red Hat Enterprise Linux 9.8.z, 9.9, 10.2.z, 10.3, and Red Hat In-Vehicle OS, while older RHEL versions are not impacted due to the absence of the vulnerable code.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.