CVE-2026-74520

Received Received - Intake

Use-After-Free in Linux Kernel IOMMUFD IOPF Handling

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: iommu/iommufd: Fix IOPF group ownership UAF iopf_group_alloc() links each last-page IOPF group into the generic IOPF pending list before invoking the domain fault handler. iommufd_fault_iopf_handler() also queued an accepted group in the IOMMUFD deliver list without removing it from the generic pending list. When detach or HWPT replacement drops the device's IOPF reference count to zero, an IOMMU driver may call iopf_queue_remove_device(). That function responds to and frees groups through the generic pending list without removing the same groups from IOMMUFD's deliver list or response xarray. A later read, response, or cleanup can then access the freed group and cause a UAF. Fix this by dequeuing an accepted group from the generic pending list before IOMMUFD queues it for userspace response. Make iopf_group_response() send a response regardless of pending-list membership, so the dequeued group can still be completed by IOMMUFD.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74520

EUVD

EUVD-2026-59713

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free (UAF) vulnerability in the Linux kernel's IOMMU subsystem. It occurs when the iommu/iommufd component improperly manages IOPF (I/O Page Fault) group ownership. The issue arises when groups are freed from one list but not removed from another, leading to potential access of freed memory.

Detection Guidance

This vulnerability is specific to the Linux kernel's IOMMU subsystem and requires kernel-level inspection. Detection involves checking kernel logs for IOMMU-related errors or using kernel debugging tools like dmesg or ftrace to monitor IOMMU fault handling. No network-specific detection commands are applicable.

Impact Analysis

This vulnerability could allow an attacker with local access to cause a system crash, execute arbitrary code, or escalate privileges. It primarily affects systems using IOMMU features, which are common in virtualization and security-sensitive environments.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level memory management issue in the Linux kernel's IOMMU subsystem. Compliance impacts would only occur if this flaw were exploited to gain unauthorized access or cause data breaches, which is not described in the provided context.

Mitigation Strategies

Apply the latest Linux kernel patches that include the fix for CVE-2026-74520. Monitor kernel logs for IOMMU-related errors and consider disabling IOMMU features if not required. Ensure IOMMUFD is updated to a patched version.

Hi! I’m here to help you understand CVE-2026-74520. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70