CVE-2026-53372

A flaw was found in the Linux kernel's Input/Output Memory Management Unit (IOMMU) subsystem. This vulnerability arises in virtualized environments when a nested domain attempts to attach to a Process Address Space ID (PASID), a mechanism for devices to access memory, while its parent domain is configured for dirty page tracking. The kernel lacks proper dirty tracking support for the nested domain in this scenario, leading to a failure in attachment and the potential loss of dirty pages. This can result in data integrity issues or system instability within the virtualized environment.

This vulnerability is rated as having Moderate impact because exploitation requires a specific virtualized hardware configuration with nested IOMMU translation, Process Address Space ID (PASID) support, and active dirty page logging on the parent domain. In standard Red Hat Enterprise Linux host deployments, nested translation combined with PASID dirty tracking is not enabled by default and requires advanced virtualized device assignment. Although unhandled tracking during attachment could cause dirty pages to be dropped and lead to guest data corruption or denial of service, the blast radius is confined to virtual machines utilizing this nested hardware pass-through setup.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.