GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-74520 (GCVE-0-2026-74520)

Vulnerability from cvelistv5 – Published: 2026-08-15 12:27 – Updated: 2026-08-17 05:48
VLAI
Title
iommu/iommufd: Fix IOPF group ownership UAF
Summary
In the Linux kernel, the following vulnerability has been resolved: iommu/iommufd: Fix IOPF group ownership UAF iopf_group_alloc() links each last-page IOPF group into the generic IOPF pending list before invoking the domain fault handler. iommufd_fault_iopf_handler() also queued an accepted group in the IOMMUFD deliver list without removing it from the generic pending list. When detach or HWPT replacement drops the device's IOPF reference count to zero, an IOMMU driver may call iopf_queue_remove_device(). That function responds to and frees groups through the generic pending list without removing the same groups from IOMMUFD's deliver list or response xarray. A later read, response, or cleanup can then access the freed group and cause a UAF. Fix this by dequeuing an accepted group from the generic pending list before IOMMUFD queues it for userspace response. Make iopf_group_response() send a response regardless of pending-list membership, so the dequeued group can still be completed by IOMMUFD.
Severity
8.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 34765cbc679c59ea5d952d738d2d16bf4aadc497 , < 6da8f37419dd4c456f26fc203f04e000186f4b3d (git)
Affected: 34765cbc679c59ea5d952d738d2d16bf4aadc497 , < 4e74a369236424114b94cf6a9f5ff9e848b430b4 (git)
Affected: 34765cbc679c59ea5d952d738d2d16bf4aadc497 , < 738e6f32e61d80b554e37015ecb7bc620b88001c (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.11
Unaffected: 0 , < 6.11 (semver)
Unaffected: 6.18.44 , ≤ 6.18.* (semver)
Unaffected: 7.1.8 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/io-pgfault.c",
            "drivers/iommu/iommufd/eventq.c",
            "include/linux/iommu.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6da8f37419dd4c456f26fc203f04e000186f4b3d",
              "status": "affected",
              "version": "34765cbc679c59ea5d952d738d2d16bf4aadc497",
              "versionType": "git"
            },
            {
              "lessThan": "4e74a369236424114b94cf6a9f5ff9e848b430b4",
              "status": "affected",
              "version": "34765cbc679c59ea5d952d738d2d16bf4aadc497",
              "versionType": "git"
            },
            {
              "lessThan": "738e6f32e61d80b554e37015ecb7bc620b88001c",
              "status": "affected",
              "version": "34765cbc679c59ea5d952d738d2d16bf4aadc497",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/io-pgfault.c",
            "drivers/iommu/iommufd/eventq.c",
            "include/linux/iommu.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/iommufd: Fix IOPF group ownership UAF\n\niopf_group_alloc() links each last-page IOPF group into the generic IOPF\npending list before invoking the domain fault handler.\niommufd_fault_iopf_handler() also queued an accepted group in the\nIOMMUFD deliver list without removing it from the generic pending list.\n\nWhen detach or HWPT replacement drops the device\u0027s IOPF reference count\nto zero, an IOMMU driver may call iopf_queue_remove_device(). That\nfunction responds to and frees groups through the generic pending list\nwithout removing the same groups from IOMMUFD\u0027s deliver list or response\nxarray. A later read, response, or cleanup can then access the freed\ngroup and cause a UAF.\n\nFix this by dequeuing an accepted group from the generic pending list\nbefore IOMMUFD queues it for userspace response.\nMake iopf_group_response() send a response regardless of pending-list\nmembership, so the dequeued group can still be completed by IOMMUFD."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local ioctl/read/write on /dev/iommu or /dev/vfio and the iommufd fault-queue fd; the UAF is reached only through userspace-driven IOPF setup, fault delivery, and detach/HWPT-replace, not via any network packet or remote protocol handler.\nAC:L - The attacker controls both sides of the race by concurrently triggering IOMMU page faults (device DMA to unmapped IOVAs) and detaching or replacing the HWPT via iommufd ioctls, then reading/responding on the fault fd; no victim timing or uncontrollable memory layout is required.\nPR:L - Only a local process with access to an iommufd/VFIO context and an IOPF-capable assigned device (typical GPU/accelerator passthrough tenant) is needed; no host root/CAP_SYS_ADMIN is required once the device is bound to the caller\u0027s iommufd fd.\nUI:N - All steps\u2014allocating the fault queue, attaching a fault-enabled HWPT, provoking PRI/IOPF events, detaching/replacing, and reading/writing the fault fd\u2014are performed entirely by the attacking process without requiring any separate victim user action.\nS:C - The UAF corrupts iopf_group objects that hold attach_handle and fault_param pointers governing IOMMU page-fault responses and DMA translation; successful exploitation can bypass IOMMU DMA isolation or compromise the host from a VFIO device assignment security boundary.\nC:H - Use-after-free of iopf_group lets an attacker reclaim the freed slab and control fields such as attach_handle and fault_param, enabling arbitrary kernel memory reads through subsequent fault-queue read/response paths and iopf_group_response dereferences.\nI:H - Controlled reuse of the freed iopf_group can corrupt list/xarray links and attach_handle pointers used by iopf_group_response and IOMMU fault completion, providing heap-spray-based arbitrary write and potential control-flow hijack for privilege escalation or DMA remapping.\nA:H - Accessing a freed iopf_group during fault-fd read, write, auto-response on detach, or fault-object destruction causes kernel oops/panic; the bug is a confirmed UAF in a hot fault-handling path with reliably triggerable crash outcomes."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:48:12.331Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6da8f37419dd4c456f26fc203f04e000186f4b3d"
        },
        {
          "url": "https://git.kernel.org/stable/c/4e74a369236424114b94cf6a9f5ff9e848b430b4"
        },
        {
          "url": "https://git.kernel.org/stable/c/738e6f32e61d80b554e37015ecb7bc620b88001c"
        }
      ],
      "title": "iommu/iommufd: Fix IOPF group ownership UAF",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74520",
    "datePublished": "2026-08-15T12:27:38.712Z",
    "dateReserved": "2026-08-15T05:44:03.911Z",
    "dateUpdated": "2026-08-17T05:48:12.331Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74520",
      "date": "2026-09-04",
      "epss": "0.00127",
      "percentile": "0.02662"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-74520\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-15T13:17:57.210\",\"lastModified\":\"2026-08-17T06:19:48.827\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\niommu/iommufd: Fix IOPF group ownership UAF\\n\\niopf_group_alloc() links each last-page IOPF group into the generic IOPF\\npending list before invoking the domain fault handler.\\niommufd_fault_iopf_handler() also queued an accepted group in the\\nIOMMUFD deliver list without removing it from the generic pending list.\\n\\nWhen detach or HWPT replacement drops the device\u0027s IOPF reference count\\nto zero, an IOMMU driver may call iopf_queue_remove_device(). That\\nfunction responds to and frees groups through the generic pending list\\nwithout removing the same groups from IOMMUFD\u0027s deliver list or response\\nxarray. A later read, response, or cleanup can then access the freed\\ngroup and cause a UAF.\\n\\nFix this by dequeuing an accepted group from the generic pending list\\nbefore IOMMUFD queues it for userspace response.\\nMake iopf_group_response() send a response regardless of pending-list\\nmembership, so the dequeued group can still be completed by IOMMUFD.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/iommu/io-pgfault.c\",\"drivers/iommu/iommufd/eventq.c\",\"include/linux/iommu.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"34765cbc679c59ea5d952d738d2d16bf4aadc497\",\"lessThan\":\"6da8f37419dd4c456f26fc203f04e000186f4b3d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"34765cbc679c59ea5d952d738d2d16bf4aadc497\",\"lessThan\":\"4e74a369236424114b94cf6a9f5ff9e848b430b4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"34765cbc679c59ea5d952d738d2d16bf4aadc497\",\"lessThan\":\"738e6f32e61d80b554e37015ecb7bc620b88001c\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/iommu/io-pgfault.c\",\"drivers/iommu/iommufd/eventq.c\",\"include/linux/iommu.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.11\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.11\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.44\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.8\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.0,\"impactScore\":6.0}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/4e74a369236424114b94cf6a9f5ff9e848b430b4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6da8f37419dd4c456f26fc203f04e000186f4b3d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/738e6f32e61d80b554e37015ecb7bc620b88001c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-20T22:18:46+00:00",
      "cve": "CVE-2026-74520",
      "id": "CVE-2026-74520",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: iommu/iommufd: Fix IOPF group ownership UAF",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74520.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.