CVE-2026-74573

Received Received - Intake

Stream ID Mapping Flaw in Linux Kernel IOMMU

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE arm_vsmmu_vsid_to_sid() maps a guest's vSID to a single physical Stream ID taken from master->streams[0], assuming a device has exactly one stream. A device with several streams gets only its first one mapped, so a guest vSID invalidation cannot reach the others' ATC and IOTLB entries; a device with none makes master->streams a ZERO_SIZE_PTR, read out of bounds. Add an arm_vsmmu_vdevice_init() op to reject the vDEVICE with -EOPNOTSUPP when master->num_streams is not one, rather than mapping it silently.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74573

EUVD

EUVD-2026-59638

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves incorrect handling of Stream IDs in the arm-smmu-v3-iommufd component. The issue occurs when a virtual device (vDEVICE) is created with either zero or multiple Stream IDs instead of exactly one. This leads to out-of-bounds memory access or incomplete invalidation of address translation caches.

Detection Guidance

This vulnerability is specific to the Linux kernel's IOMMU subsystem and requires kernel-level inspection. Detection involves checking kernel logs for IOMMU-related errors or examining the arm-smmu-v3 driver behavior. Commands like dmesg | grep -i iommu or journalctl -k | grep -i smmu may help identify issues. Ensure your kernel version is checked against patched versions.

Impact Analysis

This flaw could allow a guest system to bypass security boundaries or cause memory corruption in the IOMMU subsystem. It may lead to denial-of-service conditions, privilege escalation, or data leaks depending on the affected system configuration.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it pertains to a low-level memory management issue in the Linux kernel's IOMMU subsystem. Compliance impacts would depend on system-specific configurations and usage rather than this vulnerability itself.

Mitigation Strategies

Apply the latest kernel patches from your Linux distribution to resolve the issue. If immediate patching is not possible, avoid using IOMMU passthrough for devices with multiple streams or no streams. Monitor kernel logs for IOMMU errors and restrict guest VMs with untrusted devices until patched.

Hi! I’m here to help you understand CVE-2026-74573. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70