GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-43253 (GCVE-0-2026-43253)

Vulnerability from cvelistv5 – Published: 2026-05-06 11:28 – Updated: 2026-08-05 12:26
VLAI
Title
iommu/amd: move wait_on_sem() out of spinlock
Summary
In the Linux kernel, the following vulnerability has been resolved: iommu/amd: move wait_on_sem() out of spinlock With iommu.strict=1, the existing completion wait path can cause soft lockups under stressed environment, as wait_on_sem() busy-waits under the spinlock with interrupts disabled. Move the completion wait in iommu_completion_wait() out of the spinlock. wait_on_sem() only polls the hardware-updated cmd_sem and does not require iommu->lock, so holding the lock during the busy wait unnecessarily increases contention and extends the time with interrupts disabled.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 4bf5beef578e46393f11eb69dda7d17a065e05ff , < f2f65b28d802a667119147444ec2ae33eebf9a58 (git)
Affected: 4bf5beef578e46393f11eb69dda7d17a065e05ff , < 715c263119fd1b918a9fcbd8a36ea5b604a46324 (git)
Affected: 4bf5beef578e46393f11eb69dda7d17a065e05ff , < e15768e68820142077bbca402d8e902f64ade1b0 (git)
Affected: 4bf5beef578e46393f11eb69dda7d17a065e05ff , < 496269d12072ecb219826485bdbec70c92a8eef5 (git)
Affected: 4bf5beef578e46393f11eb69dda7d17a065e05ff , < d2a0cac10597068567d336e85fa3cbdbe8ca62bf (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.9
Unaffected: 0 , < 4.9 (semver)
Unaffected: 6.6.128 , ≤ 6.6.* (semver)
Unaffected: 6.12.75 , ≤ 6.12.* (semver)
Unaffected: 6.18.16 , ≤ 6.18.* (semver)
Unaffected: 6.19.6 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/amd/iommu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f2f65b28d802a667119147444ec2ae33eebf9a58",
              "status": "affected",
              "version": "4bf5beef578e46393f11eb69dda7d17a065e05ff",
              "versionType": "git"
            },
            {
              "lessThan": "715c263119fd1b918a9fcbd8a36ea5b604a46324",
              "status": "affected",
              "version": "4bf5beef578e46393f11eb69dda7d17a065e05ff",
              "versionType": "git"
            },
            {
              "lessThan": "e15768e68820142077bbca402d8e902f64ade1b0",
              "status": "affected",
              "version": "4bf5beef578e46393f11eb69dda7d17a065e05ff",
              "versionType": "git"
            },
            {
              "lessThan": "496269d12072ecb219826485bdbec70c92a8eef5",
              "status": "affected",
              "version": "4bf5beef578e46393f11eb69dda7d17a065e05ff",
              "versionType": "git"
            },
            {
              "lessThan": "d2a0cac10597068567d336e85fa3cbdbe8ca62bf",
              "status": "affected",
              "version": "4bf5beef578e46393f11eb69dda7d17a065e05ff",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/amd/iommu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.9"
            },
            {
              "lessThan": "4.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.128",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.16",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.6",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/amd: move wait_on_sem() out of spinlock\n\nWith iommu.strict=1, the existing completion wait path can cause soft\nlockups under stressed environment, as wait_on_sem() busy-waits under the\nspinlock with interrupts disabled.\n\nMove the completion wait in iommu_completion_wait() out of the spinlock.\nwait_on_sem() only polls the hardware-updated cmd_sem and does not require\niommu-\u003elock, so holding the lock during the busy wait unnecessarily\nincreases contention and extends the time with interrupts disabled."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - On AMD systems where the IOMMU protects a PCIe NIC, received packets can drive NIC RX cleanup through DMA unmap, IOTLB sync, amd_iommu_iotlb_sync(), iommu_completion_wait(), and wait_on_sem(). A remote peer can generate this traffic without local system access.\nAC:L - Triggering requires sustained IOMMU flush pressure, but the attacker can create that pressure by sending traffic and no uncontrollable race, memory layout, or victim action is needed. The affected AMD IOMMU/translated-DMA deployment is assumed for scoring.\nPR:N - The highest reasonable path is unauthenticated network receive processing on an internet-facing server NIC. No local account, capability, or namespace access is required to cause packet-driven DMA cleanup.\nUI:N - No victim user action is required once the affected system is running and receiving network traffic. The kernel/NIC interrupt and NAPI paths process packets automatically.\nS:U - The issue causes a host-kernel availability failure within the same security authority. It does not bypass IOMMU/DMA isolation, escape a VM, or cross into another security scope.\nC:N - The bug is a busy wait under a spinlock with interrupts disabled while polling a hardware-updated command semaphore. There is no memory corruption, out-of-bounds read, or information disclosure primitive.\nI:N - The vulnerable path does not corrupt memory or provide an attacker-controlled write. It only causes excessive locked/IRQ-disabled waiting during IOMMU command completion.\nA:H - The fix and related reports describe soft lockups/RCU stalls caused by wait_on_sem() spinning while holding the IOMMU lock with interrupts disabled. Repeated triggering can hang or severely stall the kernel, so availability impact is high."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:26:53.719Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f2f65b28d802a667119147444ec2ae33eebf9a58"
        },
        {
          "url": "https://git.kernel.org/stable/c/715c263119fd1b918a9fcbd8a36ea5b604a46324"
        },
        {
          "url": "https://git.kernel.org/stable/c/e15768e68820142077bbca402d8e902f64ade1b0"
        },
        {
          "url": "https://git.kernel.org/stable/c/496269d12072ecb219826485bdbec70c92a8eef5"
        },
        {
          "url": "https://git.kernel.org/stable/c/d2a0cac10597068567d336e85fa3cbdbe8ca62bf"
        }
      ],
      "title": "iommu/amd: move wait_on_sem() out of spinlock",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43253",
    "datePublished": "2026-05-06T11:28:43.160Z",
    "dateReserved": "2026-05-01T14:12:55.996Z",
    "dateUpdated": "2026-08-05T12:26:53.719Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-43253",
      "date": "2026-09-16",
      "epss": "0.0034",
      "percentile": "0.27369"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-43253\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-06T12:16:46.033\",\"lastModified\":\"2026-06-17T10:49:14.983\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\niommu/amd: move wait_on_sem() out of spinlock\\n\\nWith iommu.strict=1, the existing completion wait path can cause soft\\nlockups under stressed environment, as wait_on_sem() busy-waits under the\\nspinlock with interrupts disabled.\\n\\nMove the completion wait in iommu_completion_wait() out of the spinlock.\\nwait_on_sem() only polls the hardware-updated cmd_sem and does not require\\niommu-\u003elock, so holding the lock during the busy wait unnecessarily\\nincreases contention and extends the time with interrupts disabled.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/iommu/amd/iommu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4bf5beef578e46393f11eb69dda7d17a065e05ff\",\"lessThan\":\"f2f65b28d802a667119147444ec2ae33eebf9a58\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4bf5beef578e46393f11eb69dda7d17a065e05ff\",\"lessThan\":\"715c263119fd1b918a9fcbd8a36ea5b604a46324\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4bf5beef578e46393f11eb69dda7d17a065e05ff\",\"lessThan\":\"e15768e68820142077bbca402d8e902f64ade1b0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4bf5beef578e46393f11eb69dda7d17a065e05ff\",\"lessThan\":\"496269d12072ecb219826485bdbec70c92a8eef5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4bf5beef578e46393f11eb69dda7d17a065e05ff\",\"lessThan\":\"d2a0cac10597068567d336e85fa3cbdbe8ca62bf\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/iommu/amd/iommu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.9\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.9\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.128\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.75\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.16\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19.6\",\"lessThanOrEqual\":\"6.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-667\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.9\",\"versionEndExcluding\":\"6.6.128\",\"matchCriteriaId\":\"FC8C6130-AEEE-4496-B72F-C7A386E011DC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.75\",\"matchCriteriaId\":\"BCE16369-98ED-41CF-8995-DFDC10B288D2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.16\",\"matchCriteriaId\":\"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.6\",\"matchCriteriaId\":\"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/496269d12072ecb219826485bdbec70c92a8eef5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/715c263119fd1b918a9fcbd8a36ea5b604a46324\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d2a0cac10597068567d336e85fa3cbdbe8ca62bf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e15768e68820142077bbca402d8e902f64ade1b0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f2f65b28d802a667119147444ec2ae33eebf9a58\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-07-02T12:52:25+00:00",
      "cve": "CVE-2026-43253",
      "id": "CVE-2026-43253",
      "initial_release_date": "2026-05-06T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: iommu/amd: move wait_on_sem() out of spinlock",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43253.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-16T00:14:02Z",
      "cve": "CVE-2026-43253",
      "id": "CVE-2026-43253",
      "initial_release_date": "2026-05-07T02:16:40Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "270",
      "product_status:recommended": "273",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-43253",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-43253.json",
      "version": "14"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.