{"id":"CVE-2026-43253","title":"iommu/amd: move wait_on_sem() out of spinlock","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\niommu/amd: move wait_on_sem() out of spinlock\n\nWith iommu.strict=1, the existing completion wait path can cause soft\nlockups under stressed environment, as wait_on_sem(…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 4bf5beef578e46393f11eb69dda7d17a065e05ff < f2f65b28d802a667119147444ec2ae33eebf9a58","Linux >= 4bf5beef578e46393f11eb69dda7d17a065e05ff < 715c263119fd1b918a9fcbd8a36ea5b604a46324","Linux >= 4bf5beef578e46393f11eb69dda7d17a065e05ff < e15768e68820142077bbca402d8e902f64ade1b0","Linux >= 4bf5beef578e46393f11eb69dda7d17a065e05ff < 496269d12072ecb219826485bdbec70c92a8eef5","Linux >= 4bf5beef578e46393f11eb69dda7d17a065e05ff < d2a0cac10597068567d336e85fa3cbdbe8ca62bf","Linux 4.9"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-16T15:16:08.841212Z"},"published":"2026-05-06","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:20:37.900Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-43253","references":[{"url":"https://git.kernel.org/stable/c/f2f65b28d802a667119147444ec2ae33eebf9a58"},{"url":"https://git.kernel.org/stable/c/715c263119fd1b918a9fcbd8a36ea5b604a46324"},{"url":"https://git.kernel.org/stable/c/e15768e68820142077bbca402d8e902f64ade1b0"},{"url":"https://git.kernel.org/stable/c/496269d12072ecb219826485bdbec70c92a8eef5"},{"url":"https://git.kernel.org/stable/c/d2a0cac10597068567d336e85fa3cbdbe8ca62bf"}],"tags":["cve.org"],"epss":0.00486,"epssPercentile":0.40473,"ingestedAt":"2026-10-16T17:24:46.690Z","slug":"CVE-2026-43253","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niommu/amd: move wait_on_sem() out of spinlock\n\nWith iommu.strict=1, the existing completion wait path can cause soft\nlockups under stressed environment, as wait_on_sem() busy-waits under the\nspinlock with interrupts disabled.\n\nMove the completion wait in iommu_completion_wait() out of the spinlock.\nwait_on_sem() only polls the hardware-updated cmd_sem and does not require\niommu->lock, so holding the lock during the busy wait unnecessarily\nincreases contention and extends the time with interrupts disabled.\n\n## Affected\n\n- `Linux >= 4bf5beef578e46393f11eb69dda7d17a065e05ff < f2f65b28d802a667119147444ec2ae33eebf9a58`\n- `Linux >= 4bf5beef578e46393f11eb69dda7d17a065e05ff < 715c263119fd1b918a9fcbd8a36ea5b604a46324`\n- `Linux >= 4bf5beef578e46393f11eb69dda7d17a065e05ff < e15768e68820142077bbca402d8e902f64ade1b0`\n- `Linux >= 4bf5beef578e46393f11eb69dda7d17a065e05ff < 496269d12072ecb219826485bdbec70c92a8eef5`\n- `Linux >= 4bf5beef578e46393f11eb69dda7d17a065e05ff < d2a0cac10597068567d336e85fa3cbdbe8ca62bf`\n- `Linux 4.9`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}