8.8

CVE-2026-53053: linux

CVSS: 8.8v3.1HighModified
AliasesUBUNTU-CVE-2026-53053DEBIAN-CVE-2026-53053
Published 24-06-2026Last modified 19-10-2026
Open JSON

Vulnerability summary

CVE-2026-53053 is a high (CVSS 8.8) vulnerability in linux. EPSS estimates a 0.13% chance of exploitation in the next 30 days, higher than 2.2% of scored vulnerabilities.

Overall risk
35/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.8/10
010
High · v3.1 (CVE.org)
EPSS score
0.13%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 32 · Related 28
OPENSUSE-SU-2026:21388-1RHSA-2026:61887RHSA-2026:67150RHSA-2026:70402RHSA-2026:70403SUSE-SU-2026:22521-1

Timeline

  1. 24-06-2026
    PublishedVulnerability first disclosed.
  2. 19-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix clone_alias() to use the original device's devid Currently clone_alias() assumes first argument (pdev) is always the original device pointer. This function is called by pci_for_each_dma_alias() which based on topology decides to send original or alias device details in first argument. This meant that the source devid used to look up and copy the DTE may be incorrect, leading to wrong or stale DTE entries being propagated to alias device. Fix this by passing the original pdev as the opaque data argument to both the direct clone_alias() call and pci_for_each_dma_alias(). Inside clone_alias(), retrieve the original device from data and compute devid from it.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.13%

Chance of exploitation in the next 30 days

Percentile

2%

Versus all other CVEs

30-day change

0.00 pp

From 0.13% on 20-09-2026

20-09-202620-10-2026
EPSS score
0.13%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Ubuntu164 products
  • linuxAll versions (No fix recorded) | < 7.0.0-28.28
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 7.0.0-1009.9
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ 3332364e4ebc0581d133a334645a20fd13b580f1, < dbd76a537d8cb814e7f5b795ab21ecb7949c821d | ≥ 3332364e4ebc0581d133a334645a20fd13b580f1, < 20b3c566e2702e5d4d0545be8a97029a2eebcc0e | ≥ 3332364e4ebc0581d133a334645a20fd13b580f1, < dae251ff11d2d2208a029f98923756831cefec46 | ≥ 3332364e4ebc0581d133a334645a20fd13b580f1, < faad224fe0f0857a04ff2eb3c90f0de57f47d0f3 | 1f03a258f20f1699ede29bb40804074db9398a0d | ≥ 5.4.17, < 5.5 | 5.5
  • linux_kernel≥ 5.4.17, < 6.12.91 | ≥ 6.13, < 6.18.33 | ≥ 6.19, < 7.0.10
Debian1 product
  • linuxAll versions (No fix recorded) | < 6.12.94-1 | < 7.0.10-1

3 vendors · 167 products

References

20 links
Show all 20 references