Bug 2492310 (CVE-2026-53053) - CVE-2026-53053 kernel: iommu/amd: Fix clone_alias() to use the original device's devid
Summary: CVE-2026-53053 kernel: iommu/amd: Fix clone_alias() to use the original devic...
Keywords:
Status: NEW
Alias: CVE-2026-53053
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-06-24 18:04 UTC by OSIDB Bzimport
Modified: 2026-09-01 07:30 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:61887 0 None None None 2026-09-01 07:30:22 UTC

Description OSIDB Bzimport 2026-06-24 18:04:56 UTC
In the Linux kernel, the following vulnerability has been resolved:

iommu/amd: Fix clone_alias() to use the original device's devid

Currently clone_alias() assumes first argument (pdev) is always the
original device pointer. This function is called by
pci_for_each_dma_alias() which based on topology decides to send
original or alias device details in first argument.

This meant that the source devid used to look up and copy the DTE
may be incorrect, leading to wrong or stale DTE entries being
propagated to alias device.

Fix this by passing the original pdev as the opaque data argument to
both the direct clone_alias() call and pci_for_each_dma_alias(). Inside
clone_alias(), retrieve the original device from data and compute devid
from it.

Comment 4 errata-xmlrpc 2026-09-01 07:30:21 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:61887 https://access.redhat.com/errata/RHSA-2026:61887


Note You need to log in before you can comment on or make changes to this bug.