{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/io-pgfault.c",
            "drivers/iommu/iommufd/eventq.c",
            "include/linux/iommu.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6da8f37419dd4c456f26fc203f04e000186f4b3d",
              "status": "affected",
              "version": "34765cbc679c59ea5d952d738d2d16bf4aadc497",
              "versionType": "git"
            },
            {
              "lessThan": "4e74a369236424114b94cf6a9f5ff9e848b430b4",
              "status": "affected",
              "version": "34765cbc679c59ea5d952d738d2d16bf4aadc497",
              "versionType": "git"
            },
            {
              "lessThan": "738e6f32e61d80b554e37015ecb7bc620b88001c",
              "status": "affected",
              "version": "34765cbc679c59ea5d952d738d2d16bf4aadc497",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/io-pgfault.c",
            "drivers/iommu/iommufd/eventq.c",
            "include/linux/iommu.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/iommufd: Fix IOPF group ownership UAF\n\niopf_group_alloc() links each last-page IOPF group into the generic IOPF\npending list before invoking the domain fault handler.\niommufd_fault_iopf_handler() also queued an accepted group in the\nIOMMUFD deliver list without removing it from the generic pending list.\n\nWhen detach or HWPT replacement drops the device\u0027s IOPF reference count\nto zero, an IOMMU driver may call iopf_queue_remove_device(). That\nfunction responds to and frees groups through the generic pending list\nwithout removing the same groups from IOMMUFD\u0027s deliver list or response\nxarray. A later read, response, or cleanup can then access the freed\ngroup and cause a UAF.\n\nFix this by dequeuing an accepted group from the generic pending list\nbefore IOMMUFD queues it for userspace response.\nMake iopf_group_response() send a response regardless of pending-list\nmembership, so the dequeued group can still be completed by IOMMUFD."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local ioctl/read/write on /dev/iommu or /dev/vfio and the iommufd fault-queue fd; the UAF is reached only through userspace-driven IOPF setup, fault delivery, and detach/HWPT-replace, not via any network packet or remote protocol handler.\nAC:L - The attacker controls both sides of the race by concurrently triggering IOMMU page faults (device DMA to unmapped IOVAs) and detaching or replacing the HWPT via iommufd ioctls, then reading/responding on the fault fd; no victim timing or uncontrollable memory layout is required.\nPR:L - Only a local process with access to an iommufd/VFIO context and an IOPF-capable assigned device (typical GPU/accelerator passthrough tenant) is needed; no host root/CAP_SYS_ADMIN is required once the device is bound to the caller\u0027s iommufd fd.\nUI:N - All steps\u2014allocating the fault queue, attaching a fault-enabled HWPT, provoking PRI/IOPF events, detaching/replacing, and reading/writing the fault fd\u2014are performed entirely by the attacking process without requiring any separate victim user action.\nS:C - The UAF corrupts iopf_group objects that hold attach_handle and fault_param pointers governing IOMMU page-fault responses and DMA translation; successful exploitation can bypass IOMMU DMA isolation or compromise the host from a VFIO device assignment security boundary.\nC:H - Use-after-free of iopf_group lets an attacker reclaim the freed slab and control fields such as attach_handle and fault_param, enabling arbitrary kernel memory reads through subsequent fault-queue read/response paths and iopf_group_response dereferences.\nI:H - Controlled reuse of the freed iopf_group can corrupt list/xarray links and attach_handle pointers used by iopf_group_response and IOMMU fault completion, providing heap-spray-based arbitrary write and potential control-flow hijack for privilege escalation or DMA remapping.\nA:H - Accessing a freed iopf_group during fault-fd read, write, auto-response on detach, or fault-object destruction causes kernel oops/panic; the bug is a confirmed UAF in a hot fault-handling path with reliably triggerable crash outcomes."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:48:12.331Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6da8f37419dd4c456f26fc203f04e000186f4b3d"
        },
        {
          "url": "https://git.kernel.org/stable/c/4e74a369236424114b94cf6a9f5ff9e848b430b4"
        },
        {
          "url": "https://git.kernel.org/stable/c/738e6f32e61d80b554e37015ecb7bc620b88001c"
        }
      ],
      "title": "iommu/iommufd: Fix IOPF group ownership UAF",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74520",
    "datePublished": "2026-08-15T12:27:38.712Z",
    "dateReserved": "2026-08-15T05:44:03.911Z",
    "dateUpdated": "2026-08-17T05:48:12.331Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}