UBUNTU-CVE-2026-74277

In the Linux kernel, the following vulnerability has been resolved: iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path In iommudmamapsg, when handling PCI P2PDMA cases, the DMA length of the current scatterlist segment s is incorrectly assigned from the head entry sg-length...

UBUNTU-CVE-2026-74380

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix iommumapsgtable return value check Commit "iommu: return full error code from iommumapsgatomic" changed iommumapsgtable to return an ssizet and negative values in error cases, rather than a sizet and a zero. pinj...

UBUNTU-CVE-2026-74439

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry devicepasidtableteardown zeroes the 128-bit scalable-mode context entry with contextclearentry while the Present bit is still set. This creates a windo...

CVE-2026-74439

CVE-2026-74439 affects the Linux kernel IOMMU VT-d path. The vulnerability arises in device_pasid_table_teardown(), which zeroes a 128‑bit scalable‑mode context entry while the Present bit is still set. This creates a window where a torn entry could be fetched by the hardware with some fields alr...

EUVD-2026-59586

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry devicepasidtableteardown zeroes the 128-bit scalable-mode context entry with contextclearentry while the Present bit is still set. This creates a windo...

CVE-2026-74439 iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry devicepasidtableteardown zeroes the 128-bit scalable-mode context entry with contextclearentry while the Present bit is still set. This creates a windo...

CVE-2026-74439 iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry devicepasidtableteardown zeroes the 128-bit scalable-mode context entry with contextclearentry while the Present bit is still set. This creates a windo...

CVE-2026-74380 gpu: host1x: Fix iommu_map_sgtable() return value check

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix iommumapsgtable return value check Commit "iommu: return full error code from iommumapsgatomic" changed iommumapsgtable to return an ssizet and negative values in error cases, rather than a sizet and a zero. pinj...

EUVD-2026-59502

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix RB-tree corruption in probe error path The info-node RB-tree member is zero-initialized via kzalloc. If a device does not support ATS, the devicerbtreeinsert call is skipped. If a subsequent probe step fails, the...

CVE-2026-74355 iommu/vt-d: Fix RB-tree corruption in probe error path

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix RB-tree corruption in probe error path The info-node RB-tree member is zero-initialized via kzalloc. If a device does not support ATS, the devicerbtreeinsert call is skipped. If a subsequent probe step fails, the...

CVE-2026-74277

The CVE-2026-74277 issue is in the Linux kernel iommu/dma-iommu code, specifically the P2PDMA path. In iommu_dma_map_sg(), the DMA length for the current scatterlist segment was erroneously taken from the head entry (sg->length) instead of the current entry (s->length). This causes all P2PD...

EUVD-2026-59424

In the Linux kernel, the following vulnerability has been resolved: iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path In iommudmamapsg, when handling PCI P2PDMA cases, the DMA length of the current scatterlist segment s is incorrectly assigned from the head entry sg-length...

PT-2026-72791

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix RB-tree corruption in probe error path The info-node RB-tree member is zero-initialized via kzalloc. If a device does not support ATS, the device rbtree insert call is skipped. If a subsequent probe step fails, th...

PT-2026-72713

In the Linux kernel, the following vulnerability has been resolved: iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path In iommu dma map sg, when handling PCI P2PDMA cases, the DMA length of the current scatterlist segment s is incorrectly assigned from the head entry sg-lengt...

Linux Distros Unpatched Vulnerability : CVE-2026-74573

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE armvsmmuvsidtosid maps a guest's vSID to a single physical Stream ID taken from...

PT-2026-72875

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry device pasid table teardown zeroes the 128-bit scalable-mode context entry with context clear entry while the Present bit is still set. This creates a...

PT-2026-72816

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix iommu map sgtable return value check Commit "iommu: return full error code from iommu map sg atomic" changed iommu map sgtable to return an ssize t and negative values in error cases, rather than a size t and a...

Linux Distros Unpatched Vulnerability : CVE-2026-74520

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iommu/iommufd: Fix IOPF group ownership UAF iopfgroupalloc links each last-page IOPF group into the generic IOPF pending list before invoking the domain fault...

Linux Distros Unpatched Vulnerability : CVE-2026-68347

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iommu/amd: Fix IRQ unsafe locking in gdom allocation Lockdep complains: 259.410489 ===================================================== 259.417287 WARNING:...

SUSE CVE-2026-68324

In the Linux kernel, the following vulnerability has been resolved: iommu/intel: Fix out-of-bounds memset in dmarlatencydisable dmarlatencydisable intends to zero out only the single latencystatistic entry for the given type, but the memset size was computed as sizeoflstat DMARLATENCYNUM, which...