Security readout for executives and security teams
Plain-English summary
A Linux kernel flaw can cause affected systems to become unresponsive during heavy activity when AMD IOMMU strict mode is enabled. The failure affects availability, not data confidentiality or integrity. Servers using this configuration should be prioritized because a lockup could interrupt workloads and require recovery.
Executive priority
Treat this as a high-priority availability issue for exposed production servers, especially latency-sensitive or highly consolidated workloads. Scope AMD IOMMU strict-mode systems promptly and schedule vendor-approved kernel updates. Lower priority is reasonable for systems demonstrably not using the affected configuration.
Technical view
With iommu.strict=1, the AMD IOMMU completion path busy-waits for a hardware-updated semaphore while holding a spinlock with interrupts disabled. Under stress, this can extend interrupt-disabled time, increase contention, and cause soft lockups. The kernel fix moves wait_on_sem() outside the spinlock because that polling does not require the IOMMU lock.
Likely exposure
Exposure is most likely on Linux systems using AMD IOMMU with iommu.strict=1 and an affected kernel. The supplied record lists 4.9, 6.6.128, 6.12.75, 6.18.16, 6.19.6, and 7.0, but also contains an anomalous version value of "0". Confirm applicability through distribution or vendor advisories.
Exploitation context
The supplied record is not in CISA KEV and provides no evidence of active exploitation or a public exploit. It describes an availability failure under a stressed environment. Although the CVSS vector reports network reachability, the sources do not explain how a remote party would reliably trigger the necessary conditions.
Researcher notes
The vulnerable behavior is excessive lock and interrupt-disabled duration rather than memory corruption. No CWE is assigned. The affected-version data is internally unclear, including repeated commit identifiers and an anomalous "0" entry. The five kernel.org references appear to represent stable-tree fixes, but the bundle does not map each fix to a specific release line.
Mitigation direction
- Update to a vendor-supported kernel containing the applicable cited stable fix.
- Check Linux distribution guidance for corrected package versions and reboot requirements.
- Prioritize AMD IOMMU systems configured with iommu.strict=1.
- Use vendor-approved configuration guidance if immediate kernel updating is unavailable.
Validation and detection
- Inventory kernel versions on systems using AMD IOMMU.
- Confirm whether iommu.strict=1 is enabled at boot.
- Verify the installed kernel includes the applicable stable fix or vendor backport.
- Review kernel logs and monitoring for soft lockups under workload stress.
- Confirm services remain healthy after updating and rebooting.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-43253 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6LinuxVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/f2f65b28d802a667119147444ec2ae33eebf9a58CVE reference, Linux
- https://git.kernel.org/stable/c/715c263119fd1b918a9fcbd8a36ea5b604a46324CVE reference, Linux
- https://git.kernel.org/stable/c/e15768e68820142077bbca402d8e902f64ade1b0CVE reference, Linux
- https://git.kernel.org/stable/c/496269d12072ecb219826485bdbec70c92a8eef5CVE reference, Linux
- https://git.kernel.org/stable/c/d2a0cac10597068567d336e85fa3cbdbe8ca62bfCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.