CVE-2026-53281

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> iommu/vt-d: Avoid NULL pointer dereference or refcount corruption<br /> <br /> Commit 60f030f7418d ("iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE")<br /> fixed a NULL pointer dereference in an unlikely situation partly.<br /> <br /> If dev_pasid is not found in the dev_pasids list, it remains NULL.<br /> However, the teardown operations are executed unconditionally, this lead<br /> to a NULL pointer dereference or refcount corruption.<br /> <br /> If the domain was never attached to this IOMMU, info will be NULL, which<br /> would cause an immediate dereference when checking --info-&gt;refcnt.<br /> <br /> Even if info is not NULL, decrementing the refcount without having removed<br /> a valid PASID might unbalance the count. This could lead to premature<br /> dropping of the refcount to 0, potentially causing a use-after-free for the<br /> remaining active devices sharing the domain.<br /> <br /> Fix it by returning early if dev_pasid is NULL, before executing the<br /> teardown operations.<br /> <br /> Issue found by AI review and suggested by Kevin Tian.<br /> https://sashiko.dev/#/patchset/20260421031347.1408890-1-zhenzhong.duan%40intel.com