SB20260626188 - Always-Incorrect Control Flow Implementation in Linux kernel iommu driver

Description

This security bulletin contains information about 1 vulnerability.

1) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-53164)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of a zero-length mapping and incorrect error unwind logic in iommu_dma_iova_link_swiotlb() when processing unaligned swiotlb mappings. A local user can trigger unaligned memory mappings to corrupt the mapping state and cause a denial of service.

This can be triggered by certain thunderbolt NVMe drives using forced SWIOTLB with oddly aligned buffers for passthrough commands from smartctl.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/6ec91df8aff77e2e8fe3179c1f3fc15b43a40ba3
• https://git.kernel.org/stable/c/ab61c990a87d084f5565ee70340543e3a5394697
• https://git.kernel.org/stable/c/b16f8d40bac9ced838d24c9842707af9ecae92e2