Vulnerability-Lookup

FKIE_CVE-2026-74520

Vulnerability from fkie_nvd - Published: 2026-08-15 13:17 - Updated: 2026-08-17 06:19

Severity

8.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: iommu/iommufd: Fix IOPF group ownership UAF iopf_group_alloc() links each last-page IOPF group into the generic IOPF pending list before invoking the domain fault handler. iommufd_fault_iopf_handler() also queued an accepted group in the IOMMUFD deliver list without removing it from the generic pending list. When detach or HWPT replacement drops the device's IOPF reference count to zero, an IOMMU driver may call iopf_queue_remove_device(). That function responds to and frees groups through the generic pending list without removing the same groups from IOMMUFD's deliver list or response xarray. A later read, response, or cleanup can then access the freed group and cause a UAF. Fix this by dequeuing an accepted group from the generic pending list before IOMMUFD queues it for userspace response. Make iopf_group_response() send a response regardless of pending-list membership, so the dequeued group can still be completed by IOMMUFD.

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/4e74a369236424114b94cf6a9f5ff9e848b430b4
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/6da8f37419dd4c456f26fc203f04e000186f4b3d
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/738e6f32e61d80b554e37015ecb7bc620b88001c

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/io-pgfault.c",
            "drivers/iommu/iommufd/eventq.c",
            "include/linux/iommu.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6da8f37419dd4c456f26fc203f04e000186f4b3d",
              "status": "affected",
              "version": "34765cbc679c59ea5d952d738d2d16bf4aadc497",
              "versionType": "git"
            },
            {
              "lessThan": "4e74a369236424114b94cf6a9f5ff9e848b430b4",
              "status": "affected",
              "version": "34765cbc679c59ea5d952d738d2d16bf4aadc497",
              "versionType": "git"
            },
            {
              "lessThan": "738e6f32e61d80b554e37015ecb7bc620b88001c",
              "status": "affected",
              "version": "34765cbc679c59ea5d952d738d2d16bf4aadc497",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/io-pgfault.c",
            "drivers/iommu/iommufd/eventq.c",
            "include/linux/iommu.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/iommufd: Fix IOPF group ownership UAF\n\niopf_group_alloc() links each last-page IOPF group into the generic IOPF\npending list before invoking the domain fault handler.\niommufd_fault_iopf_handler() also queued an accepted group in the\nIOMMUFD deliver list without removing it from the generic pending list.\n\nWhen detach or HWPT replacement drops the device\u0027s IOPF reference count\nto zero, an IOMMU driver may call iopf_queue_remove_device(). That\nfunction responds to and frees groups through the generic pending list\nwithout removing the same groups from IOMMUFD\u0027s deliver list or response\nxarray. A later read, response, or cleanup can then access the freed\ngroup and cause a UAF.\n\nFix this by dequeuing an accepted group from the generic pending list\nbefore IOMMUFD queues it for userspace response.\nMake iopf_group_response() send a response regardless of pending-list\nmembership, so the dequeued group can still be completed by IOMMUFD."
    }
  ],
  "id": "CVE-2026-74520",
  "lastModified": "2026-08-17T06:19:48.827",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.0,
        "impactScore": 6.0,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-08-15T13:17:57.210",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/4e74a369236424114b94cf6a9f5ff9e848b430b4"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/6da8f37419dd4c456f26fc203f04e000186f4b3d"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/738e6f32e61d80b554e37015ecb7bc620b88001c"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}

CVE-2026-74520 (GCVE-0-2026-74520)

Vulnerability from cvelistv5 – Published: 2026-08-15 12:27 – Updated: 2026-08-17 05:48

Title

iommu/iommufd: Fix IOPF group ownership UAF

Summary

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Assigner

Linux mitre root

References

3 references

URL	Tags
https://git.kernel.org/stable/c/6da8f37419dd4c456…
https://git.kernel.org/stable/c/4e74a369236424114…
https://git.kernel.org/stable/c/738e6f32e61d80b55…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 34765cbc679c59ea5d952d738d2d16bf4aadc497 , < 6da8f37419dd4c456f26fc203f04e000186f4b3d (git) Affected: 34765cbc679c59ea5d952d738d2d16bf4aadc497 , < 4e74a369236424114b94cf6a9f5ff9e848b430b4 (git) Affected: 34765cbc679c59ea5d952d738d2d16bf4aadc497 , < 738e6f32e61d80b554e37015ecb7bc620b88001c (git)
Linux	Linux	Affected: 6.11 Unaffected: 0 , < 6.11 (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/io-pgfault.c",
            "drivers/iommu/iommufd/eventq.c",
            "include/linux/iommu.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6da8f37419dd4c456f26fc203f04e000186f4b3d",
              "status": "affected",
              "version": "34765cbc679c59ea5d952d738d2d16bf4aadc497",
              "versionType": "git"
            },
            {
              "lessThan": "4e74a369236424114b94cf6a9f5ff9e848b430b4",
              "status": "affected",
              "version": "34765cbc679c59ea5d952d738d2d16bf4aadc497",
              "versionType": "git"
            },
            {
              "lessThan": "738e6f32e61d80b554e37015ecb7bc620b88001c",
              "status": "affected",
              "version": "34765cbc679c59ea5d952d738d2d16bf4aadc497",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/io-pgfault.c",
            "drivers/iommu/iommufd/eventq.c",
            "include/linux/iommu.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/iommufd: Fix IOPF group ownership UAF\n\niopf_group_alloc() links each last-page IOPF group into the generic IOPF\npending list before invoking the domain fault handler.\niommufd_fault_iopf_handler() also queued an accepted group in the\nIOMMUFD deliver list without removing it from the generic pending list.\n\nWhen detach or HWPT replacement drops the device\u0027s IOPF reference count\nto zero, an IOMMU driver may call iopf_queue_remove_device(). That\nfunction responds to and frees groups through the generic pending list\nwithout removing the same groups from IOMMUFD\u0027s deliver list or response\nxarray. A later read, response, or cleanup can then access the freed\ngroup and cause a UAF.\n\nFix this by dequeuing an accepted group from the generic pending list\nbefore IOMMUFD queues it for userspace response.\nMake iopf_group_response() send a response regardless of pending-list\nmembership, so the dequeued group can still be completed by IOMMUFD."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local ioctl/read/write on /dev/iommu or /dev/vfio and the iommufd fault-queue fd; the UAF is reached only through userspace-driven IOPF setup, fault delivery, and detach/HWPT-replace, not via any network packet or remote protocol handler.\nAC:L - The attacker controls both sides of the race by concurrently triggering IOMMU page faults (device DMA to unmapped IOVAs) and detaching or replacing the HWPT via iommufd ioctls, then reading/responding on the fault fd; no victim timing or uncontrollable memory layout is required.\nPR:L - Only a local process with access to an iommufd/VFIO context and an IOPF-capable assigned device (typical GPU/accelerator passthrough tenant) is needed; no host root/CAP_SYS_ADMIN is required once the device is bound to the caller\u0027s iommufd fd.\nUI:N - All steps\u2014allocating the fault queue, attaching a fault-enabled HWPT, provoking PRI/IOPF events, detaching/replacing, and reading/writing the fault fd\u2014are performed entirely by the attacking process without requiring any separate victim user action.\nS:C - The UAF corrupts iopf_group objects that hold attach_handle and fault_param pointers governing IOMMU page-fault responses and DMA translation; successful exploitation can bypass IOMMU DMA isolation or compromise the host from a VFIO device assignment security boundary.\nC:H - Use-after-free of iopf_group lets an attacker reclaim the freed slab and control fields such as attach_handle and fault_param, enabling arbitrary kernel memory reads through subsequent fault-queue read/response paths and iopf_group_response dereferences.\nI:H - Controlled reuse of the freed iopf_group can corrupt list/xarray links and attach_handle pointers used by iopf_group_response and IOMMU fault completion, providing heap-spray-based arbitrary write and potential control-flow hijack for privilege escalation or DMA remapping.\nA:H - Accessing a freed iopf_group during fault-fd read, write, auto-response on detach, or fault-object destruction causes kernel oops/panic; the bug is a confirmed UAF in a hot fault-handling path with reliably triggerable crash outcomes."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:48:12.331Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6da8f37419dd4c456f26fc203f04e000186f4b3d"
        },
        {
          "url": "https://git.kernel.org/stable/c/4e74a369236424114b94cf6a9f5ff9e848b430b4"
        },
        {
          "url": "https://git.kernel.org/stable/c/738e6f32e61d80b554e37015ecb7bc620b88001c"
        }
      ],
      "title": "iommu/iommufd: Fix IOPF group ownership UAF",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74520",
    "datePublished": "2026-08-15T12:27:38.712Z",
    "dateReserved": "2026-08-15T05:44:03.911Z",
    "dateUpdated": "2026-08-17T05:48:12.331Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

FKIE_CVE-2026-74520

CVE-2026-74520 (GCVE-0-2026-74520)

Tags

Sightings

Nomenclature