VYPR
Medium severity5.5NVD Advisory· Published Jun 26, 2026· Updated Jul 8, 2026

CVE-2026-53280

CVE-2026-53280

Description

In the Linux kernel, the following vulnerability has been resolved:

iommu: Fix NULL group->domain dereference in pci_dev_reset_iommu_done()

Local sashiko review pointed it out that group->domain could be NULL when a default domain fails to allocate during the first probe, which can crash at domain->ops->attach_dev dereference in __iommu_attach_device() invoked by pci_dev_reset_iommu_done().

pci_dev_reset_iommu_prepare() is fine as an old_domain pointer can be NULL.

Skip the re-attach in pci_dev_reset_iommu_done() to fix the bug.

Affected products

6
  • Linux/Kernelllm-fuzzy5 versions
    (expand)+ 4 more
    • (no CPE)
    • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*range: >=7.0,<7.0.10
    • cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*
    • cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*
    • cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*
  • osv-coords
    Range: >= 7.0.0, < 7.0.10

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.