A vulnerability in the Linux kernel's AMD IOMMU driver allows an out-of-bounds read in the __rlookup_amd_iommu() function due to missing bounds… (CVE-2026-53283)
A vulnerability in the Linux kernel's AMD IOMMU driver allows an out-of-bounds read in the __rlookup_amd_iommu() function due to missing bounds checking on the device ID index. This can cause a general protection fault (GPF) at boot time on affected systems, such as certain Google Compute Engine VMs, resulting in a denial of service. The issue arises after a kernel change that altered the memory allocation method for the lookup table, causing the out-of-bounds read to access invalid memory rather than returning NULL. The vulnerability has been fixed by adding proper bounds checking to prevent the out-of-bounds access.
AI Analysis
Technical Summary
The Linux kernel AMD IOMMU driver had a vulnerability where __rlookup_amd_iommu() indexed a lookup table using a device ID without performing its own bounds check. The caller performed a bounds check only after the lookup, allowing an out-of-bounds read if the device's BDF was not described by the IVRS. Previously, this was harmless because the table was zeroed memory, but after a change to use kvalloc(), the out-of-bounds read returned adjacent slab memory, which was then dereferenced, causing a general protection fault (GPF) at boot time. This was observed on Google Compute Engine VMs with virtualized IVRS configurations. The fix guards the array access in __rlookup_amd_iommu(), preventing the out-of-bounds read and allowing the VM to boot cleanly.
Potential Impact
The vulnerability causes a denial of service by triggering a general protection fault during system boot on affected Linux kernels when the AMD IOMMU driver processes PCI devices not described by the IVRS. There is no confidentiality or integrity impact reported. The fault prevents the system from booting properly in affected environments such as certain Google Compute Engine VMs.
Mitigation Recommendations
A fix has been applied in Linux kernel version 6.18.22 that adds proper bounds checking in __rlookup_amd_iommu() to prevent out-of-bounds reads. Systems running affected kernel versions should upgrade to 6.18.22 or later to resolve this issue. Patch status is not explicitly confirmed beyond this fix version; check the vendor advisory for the latest remediation guidance.
A vulnerability in the Linux kernel's AMD IOMMU driver allows an out-of-bounds read in the __rlookup_amd_iommu() function due to missing bounds… (CVE-2026-53283)
Description
A vulnerability in the Linux kernel's AMD IOMMU driver allows an out-of-bounds read in the __rlookup_amd_iommu() function due to missing bounds checking on the device ID index. This can cause a general protection fault (GPF) at boot time on affected systems, such as certain Google Compute Engine VMs, resulting in a denial of service. The issue arises after a kernel change that altered the memory allocation method for the lookup table, causing the out-of-bounds read to access invalid memory rather than returning NULL. The vulnerability has been fixed by adding proper bounds checking to prevent the out-of-bounds access.
CVSS v3.1
Score 5.5medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel AMD IOMMU driver had a vulnerability where __rlookup_amd_iommu() indexed a lookup table using a device ID without performing its own bounds check. The caller performed a bounds check only after the lookup, allowing an out-of-bounds read if the device's BDF was not described by the IVRS. Previously, this was harmless because the table was zeroed memory, but after a change to use kvalloc(), the out-of-bounds read returned adjacent slab memory, which was then dereferenced, causing a general protection fault (GPF) at boot time. This was observed on Google Compute Engine VMs with virtualized IVRS configurations. The fix guards the array access in __rlookup_amd_iommu(), preventing the out-of-bounds read and allowing the VM to boot cleanly.
Potential Impact
The vulnerability causes a denial of service by triggering a general protection fault during system boot on affected Linux kernels when the AMD IOMMU driver processes PCI devices not described by the IVRS. There is no confidentiality or integrity impact reported. The fault prevents the system from booting properly in affected environments such as certain Google Compute Engine VMs.
Mitigation Recommendations
A fix has been applied in Linux kernel version 6.18.22 that adds proper bounds checking in __rlookup_amd_iommu() to prevent out-of-bounds reads. Systems running affected kernel versions should upgrade to 6.18.22 or later to resolve this issue. Patch status is not explicitly confirmed beyond this fix version; check the vendor advisory for the latest remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-gv9j-3945-3x3r
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-53283"]
- Ecosystems
- []
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a4e4ed8c9d9e3dbe32883f5
Added to database: 07/08/2026, 13:21:28 UTC
Last enriched: 07/08/2026, 13:31:31 UTC
Last updated: 07/31/2026, 19:24:47 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.