CVE-2026-53283

A flaw was found in the Linux kernel's AMD IOMMU (Input/Output Memory Management Unit) driver. A local attacker or a specially configured PCI device could trigger an out-of-bounds read in the __rlookup_amd_iommu() function. This vulnerability occurs when a PCI device's Bus Device Function (BDF) is not properly described by the I/O Virtualization Reporting Structure (IVRS), causing the system to attempt to read memory outside of its allocated buffer. This can lead to a General Protection Fault (GPF) and result in a system crash, causing a Denial of Service (DoS).

This vulnerability is rated as Moderate because exploitation is limited to causing a kernel panic (denial of service) on systems utilizing AMD IOMMU architecture where ACPI IVRS table firmware mappings do not encompass all connected PCI device identifiers. The issue requires specific virtualization topologies or platform firmware anomalies during hardware enumeration at boot time rather than remote network interaction. Because memory corruption is confined to reading unmapped metadata resulting in an immediate general protection fault without compromising data integrity or confidentiality, the overall security risk is constrained.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.