CVE-2026-74439

A flaw was found in the Linux kernel's Input/Output Memory Management Unit IOMMU subsystem. The devicepasidtableteardown function incorrectly clears a scalable-mode context entry while its 'Present' bit remains set. This creates a window where the hardware can access a partially cleared entry,...

CVE-2026-74277

A flaw was found in the Linux kernel's iommu/dma-iommu component. When handling PCI Peer-to-Peer Direct Memory Access P2PDMA cases, an incorrect assignment of the scatterlist length can cause all segments in a multi-segment scatterlist to inherit the length of the first segment. This leads to...

CVE-2026-74520

A flaw was found in the Linux kernel's IOMMU Input/Output Memory Management Unit and IOMMUFD IOMMU File Descriptor components. This vulnerability is a Use-After-Free UAF, which means the system attempts to use memory that has already been released. Specifically, during device detachment or hardwa...

CVE-2026-74355

A flaw was found in the Linux kernel's iommu/vt-d component. This vulnerability occurs when the info-node RB-tree member is zero-initialized, and a device that does not support Address Translation Services ATS skips the devicerbtreeinsert call. If a subsequent probe step fails, the error path...

Linux Distros Unpatched Vulnerability : CVE-2026-74439

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry devicepasidtableteardown zeroes the 128-bit scalable-mode context entry with...

Linux Distros Unpatched Vulnerability : CVE-2026-74355

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iommu/vt-d: Fix RB-tree corruption in probe error path The info-node RB-tree member is zero-initialized via kzalloc. If a device does not support ATS, the...

Linux Distros Unpatched Vulnerability : CVE-2026-74277

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path In iommudmamapsg, when handling PCI P2PDMA cases, the DMA length of the current...

kernel: iommu: disable SVA when CONFIG_X86 is set

A security vulnerability was found in the Linux kernel's IOMMU Shared Virtual Addressing SVA implementation on x86 architecture. When SVA is enabled, the IOMMU caches kernel page table entries. Since the kernel lacks a mechanism to notify the IOMMU when kernel page table pages are freed and...

SUSE CVE-2026-74573

In the Linux kernel, the following vulnerability has been resolved: iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE armvsmmuvsidtosid maps a guest's vSID to a single physical Stream ID taken from master-streams0, assuming a device has exactly one stream. A device with sever...

UBUNTU-CVE-2026-74573

In the Linux kernel, the following vulnerability has been resolved: iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE armvsmmuvsidtosid maps a guest's vSID to a single physical Stream ID taken from master-streams0, assuming a device has exactly one stream. A device with sever...

CVE-2026-74573 iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE

In the Linux kernel, the following vulnerability has been resolved: iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE armvsmmuvsidtosid maps a guest's vSID to a single physical Stream ID taken from master-streams0, assuming a device has exactly one stream. A device with sever...

CVE-2026-74573

In the Linux kernel, the following vulnerability has been resolved: iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE armvsmmuvsidtosid maps a guest's vSID to a single physical Stream ID taken from master-streams0, assuming a device has exactly one stream. A device with sever...

CVE-2026-74439

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry devicepasidtableteardown zeroes the 128-bit scalable-mode context entry with contextclearentry while the Present bit is still set. This creates a windo...

CVE-2026-74380

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix iommumapsgtable return value check Commit "iommu: return full error code from iommumapsgatomic" changed iommumapsgtable to return an ssizet and negative values in error cases, rather than a sizet and a zero. pinj...

CVE-2026-74355

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix RB-tree corruption in probe error path The info-node RB-tree member is zero-initialized via kzalloc. If a device does not support ATS, the devicerbtreeinsert call is skipped. If a subsequent probe step fails, the...

CVE-2026-74277

In the Linux kernel, the following vulnerability has been resolved: iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path In iommudmamapsg, when handling PCI P2PDMA cases, the DMA length of the current scatterlist segment s is incorrectly assigned from the head entry sg-length...

UBUNTU-CVE-2026-74277

In the Linux kernel, the following vulnerability has been resolved: iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path In iommudmamapsg, when handling PCI P2PDMA cases, the DMA length of the current scatterlist segment s is incorrectly assigned from the head entry sg-length...

UBUNTU-CVE-2026-74355

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix RB-tree corruption in probe error path The info-node RB-tree member is zero-initialized via kzalloc. If a device does not support ATS, the devicerbtreeinsert call is skipped. If a subsequent probe step fails, the...

UBUNTU-CVE-2026-74380

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix iommumapsgtable return value check Commit "iommu: return full error code from iommumapsgatomic" changed iommumapsgtable to return an ssizet and negative values in error cases, rather than a sizet and a zero. pinj...

UBUNTU-CVE-2026-74439

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry devicepasidtableteardown zeroes the 128-bit scalable-mode context entry with contextclearentry while the Present bit is still set. This creates a windo...