CVE-2026-53372: iommu/vt-d: Block PASID attachment to nested domain with dirty tracking

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-19 · updated 2026-07-29

Description

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Block PASID attachment to nested domain with dirty tracking Kernel lacks dirty tracking support on nested domain attached to PASID, fails the attachment early if nesting parent domain is dirty tracking configured, otherwise dirty pages would be lost.

Affected products

Linux kernel: from 6.13 before 6.18.30; from 6.19 before 7.0.7 — fixed in 6.18.30, 7.0.7

How to fix

Upgrade to a fixed version: Linux kernel 6.18.30, 7.0.7. Check the vendor advisory for mitigations.

References

https://git.kernel.org/stable/c/3ea9ce757bd3de955b56e7bc5672fc479e40b045
https://git.kernel.org/stable/c/9009c1af5458322469fa9a4371081a4449c5947d
https://git.kernel.org/stable/c/cc5bd898ff70710ffc41cd8e5c2741cb64750047

Get alerted when CVE-2026-53372 or the next vulnerability affects your stack