CVE-2026-53283

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.18.22

Description An issue exists in the AMD IOMMU implementation where the rlookup amd iommu() function indexes the rlookup table using the devid variable without performing a bounds check. When a PCI device has a Bus and Device Number (BDF) not described by the IOMMU Virtualization Reporting Structure (IVRS), the lookup reads memory past the end of the allocation. This occurs because the check device() path only verifies the devid after calling rlookup amd iommu().

Previously, this was harmless as the table was a zeroed page-order allocation. However, after a change to use kvcalloc(), the over-read returns adjacent slab contents. The system then dereferences this data as a struct amd iommu *, leading to a General Protection Fault (GPF) during boot. This has been observed on Google Compute Engine ct6e VMs involving gVNIC devices.

Recommendations Update the Linux kernel to version 6.18.22 or later to apply the bounds-check guard in the rlookup amd iommu() function.