CVE-2026-80687

In the Linux kernel, the following vulnerability has been resolved: iommufd/viommu: Release the igroup lock on the vdevicesize error path iommufdvdeviceallocioctl takes idev-igroup-lock, then validates the driver's vdevicesize against the core structure size with a WARNONONCE. On failure that gua...

CVE-2026-80687 iommufd/viommu: Release the igroup lock on the vdevice_size error path

In the Linux kernel, the following vulnerability has been resolved: iommufd/viommu: Release the igroup lock on the vdevicesize error path iommufdvdeviceallocioctl takes idev-igroup-lock, then validates the driver's vdevicesize against the core structure size with a WARNONONCE. On failure that gua...

EUVD-2026-67563

In the Linux kernel, the following vulnerability has been resolved: iommufd/viommu: Release the igroup lock on the vdevicesize error path iommufdvdeviceallocioctl takes idev-igroup-lock, then validates the driver's vdevicesize against the core structure size with a WARNONONCE. On failure that gua...

CVE-2026-80633 iommufd: Take dma_resv lock before dma_buf_unpin() in release path

In the Linux kernel, the following vulnerability has been resolved: iommufd: Take dmaresv lock before dmabufunpin in release path dmabufunpin requires the caller to hold the exporter's dmaresv lock: void dmabufunpinstruct dmabufattachment attach ... dmaresvasserthelddmabuf-resv;...

EUVD-2026-67509

In the Linux kernel, the following vulnerability has been resolved: iommufd: Take dmaresv lock before dmabufunpin in release path dmabufunpin requires the caller to hold the exporter's dmaresv lock: void dmabufunpinstruct dmabufattachment attach ... dmaresvasserthelddmabuf-resv;...

CVE-2026-80633

CVE-2026-80633 is a locking bug in the Linux kernel iommufd subsystem. The function iopt_release_pages() calls dma_buf_unpin() without holding the required dma_resv lock, causing a kernel WARN every time iommufd_ioas_destroy() or iommufd_ioas_unmap() releases the last reference on a DMABUF-backed...

CVE-2026-80633

In the Linux kernel, the following vulnerability has been resolved: iommufd: Take dmaresv lock before dmabufunpin in release path dmabufunpin requires the caller to hold the exporter's dmaresv lock: void dmabufunpinstruct dmabufattachment attach ... dmaresvasserthelddmabuf-resv;...

CVE-2026-80633 iommufd: Take dma_resv lock before dma_buf_unpin() in release path

In the Linux kernel, the following vulnerability has been resolved: iommufd: Take dmaresv lock before dmabufunpin in release path dmabufunpin requires the caller to hold the exporter's dmaresv lock: void dmabufunpinstruct dmabufattachment attach ... dmaresvasserthelddmabuf-resv;...

SUSE CVE-2026-74520

In the Linux kernel, the following vulnerability has been resolved: iommu/iommufd: Fix IOPF group ownership UAF iopfgroupalloc links each last-page IOPF group into the generic IOPF pending list before invoking the domain fault handler. iommufdfaultiopfhandler also queued an accepted group in the...

The vulnerability of the iommufd/selftest components of the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the iommufd/selftest components in the Linux operating system is related to a numerical overflow condition. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-74328

A flaw was found in the Linux kernel's iommufd component. This vulnerability occurs because the system attempts to destroy page content before a direct memory access buffer dmabuf is fully detached, while a mutex a mechanism to prevent simultaneous access to shared resources might still be in use...

CVE-2026-74520

A flaw was found in the Linux kernel's IOMMU Input/Output Memory Management Unit and IOMMUFD IOMMU File Descriptor components. This vulnerability is a Use-After-Free UAF, which means the system attempts to use memory that has already been released. Specifically, during device detachment or hardwa...

Linux Distros Unpatched Vulnerability : CVE-2026-74328

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iommufd: Destroy the pages content after detaching from dmabuf Sashiko points out this has gotten out of order, the mutex could still be in use through the dmab...

CVE-2026-74573

In the Linux kernel, the following vulnerability has been resolved: iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE armvsmmuvsidtosid maps a guest's vSID to a single physical Stream ID taken from master-streams0, assuming a device has exactly one stream. A device with sever...

CVE-2026-74520

In the Linux kernel, the following vulnerability has been resolved: iommu/iommufd: Fix IOPF group ownership UAF iopfgroupalloc links each last-page IOPF group into the generic IOPF pending list before invoking the domain fault handler. iommufdfaultiopfhandler also queued an accepted group in the...

CVE-2026-74520

In the Linux kernel, the following vulnerability has been resolved: iommu/iommufd: Fix IOPF group ownership UAF iopfgroupalloc links each last-page IOPF group into the generic IOPF pending list before invoking the domain fault handler. iommufdfaultiopfhandler also queued an accepted group in the...

UBUNTU-CVE-2026-74520

In the Linux kernel, the following vulnerability has been resolved: iommu/iommufd: Fix IOPF group ownership UAF iopfgroupalloc links each last-page IOPF group into the generic IOPF pending list before invoking the domain fault handler. iommufdfaultiopfhandler also queued an accepted group in the...

EUVD-2026-59713

In the Linux kernel, the following vulnerability has been resolved: iommu/iommufd: Fix IOPF group ownership UAF iopfgroupalloc links each last-page IOPF group into the generic IOPF pending list before invoking the domain fault handler. iommufdfaultiopfhandler also queued an accepted group in the...

CVE-2026-74520

The CVE-2026-74520 issue is in the Linux kernel’s iommu/iommufd path, where iopf_group_alloc() links the last-page IOPF group into the generic pending list and iommufd_fault_iopf_handler() queues an accepted group in the IOMMUFD deliver list without removing it from the generic list. When a devic...

CVE-2026-74520 iommu/iommufd: Fix IOPF group ownership UAF

In the Linux kernel, the following vulnerability has been resolved: iommu/iommufd: Fix IOPF group ownership UAF iopfgroupalloc links each last-page IOPF group into the generic IOPF pending list before invoking the domain fault handler. iommufdfaultiopfhandler also queued an accepted group in the...