Bounds Checking Vulnerability in Linux Kernel Affecting AMD IOMMU Devices

CVE-2026-53283

What is CVE-2026-53283?

A vulnerability has been identified in the Linux kernel related to the AMD IOMMU subsystem, specifically in the handling of device identifiers during the device registration process. The issue stems from potential out-of-bounds access during the lookup for an owning IOMMU. If a PCI device's identifier exceeds the allocated bounds of the reference table, it can lead to unintended memory access, causing a general protection fault (GPF) during boot time. This scenario was particularly observed in Google Compute Engine environments, where the attempt to index a non-existent device ID resulted in dereferencing invalid memory, potentially compromising system stability. The vulnerability has been addressed in recent kernel updates by enforcing stricter bounds checks, ensuring that such erroneous lookups are appropriately managed.

References