CVE-2026-74277

Received Received - Intake

Incorrect DMA Length Assignment in Linux Kernel IOMMU P2PDMA Path

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path In iommu_dma_map_sg(), when handling PCI P2PDMA cases, the DMA length of the current scatterlist segment `s` is incorrectly assigned from the head entry `sg->length` instead of the current entry `s->length`. This typo causes all P2PDMA segments in the scatterlist to inherit the length of the first segment, leading to corrupted DMA lengths for multi- segment scatterlists. Fix this by using `s->length` instead of `sg->length`.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74277

EUVD

EUVD-2026-59424

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's IOMMU DMA mapping code. It involves a typo in iommu_dma_map_sg() where the DMA length of a scatterlist segment is incorrectly taken from the head entry instead of the current segment. This causes all segments in a multi-segment scatterlist to use the first segment's length, corrupting DMA operations for PCI P2PDMA cases.

Detection Guidance

This vulnerability is specific to the Linux kernel's IOMMU DMA mapping for PCI P2PDMA cases. Detection requires checking kernel logs for IOMMU-related errors or examining kernel source code for the incorrect scatterlist length assignment. No direct network detection commands exist; system-level inspection is needed.

Impact Analysis

This flaw could lead to incorrect DMA transfers, potentially causing data corruption, system crashes, or security issues if exploited. Systems using PCI P2PDMA with scatterlists may experience unreliable IOMMU operations.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA. It is a low-level kernel issue related to incorrect DMA length assignment in scatterlist handling for PCI P2PDMA cases, which could lead to data corruption or system instability but does not inherently violate data protection or privacy regulations.

Mitigation Strategies

Apply the kernel patch that fixes the scatterlist length assignment in iommu_dma_map_sg(). Update to a patched Linux kernel version where this issue is resolved. Monitor kernel logs for IOMMU errors post-update to confirm resolution.

Hi! I’m here to help you understand CVE-2026-74277. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70