From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 59B9F3ED11D for ; Sat, 15 Aug 2026 12:31:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786797069; cv=none; b=EulnhZ2nqdhA8phSwZ+VUIUt1kfvPzOx9SZKFSotlO+vwjrO1KQnWAAMbor516R6NoJBuaMjtISnMgnqAEzcSdnfqDIci7igQBu3q1nxn5PggfaDLfO6J3aBSEzwqEJgFTsJsodG10a92uL2YLAN0Fl6X3MxiPSnbqINgBNks48= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786797069; c=relaxed/simple; bh=QTw+vp4bHvuZrDEtPK97NIlQRubzmdw7XhIFdbf97hg=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=k8n1I6o3cSLg+LGOzk3q3UnRNinESZl7PDiH3bUpYY2MyPOOppeCd810TIX0vdsrVJeuGA4RKm4QsK5OxEpH+P83Wm88/SHRKRF/jouSFvaAsaIN30fcOwHHDcdfj5OiKYwWa4HT1SjR45v5vMENp+cy7TyTGKfsatMswrb7Ff8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=zlgdOh/O; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="zlgdOh/O" Received: by smtp.kernel.org (Postfix) with ESMTPSA id B2AB81F000E9; Sat, 15 Aug 2026 12:31:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1786797068; bh=qbvWrft23GliUJzH5v3Is+Q71+l1MDvr0qgFxVRIW3E=; h=From:To:Cc:Subject:Date:Reply-To; b=zlgdOh/Oyi3eWog/FPY+SR1mBAJa3ShP12ky3u0XXvHOHnONu3ClaOB2o0WsacsI1 wt4PHGxMWqNg+lpeohMx/7PO2WCTUFMFuZ9i0MoqwgBsitIKoJslTnG1GvMm2RfvGL P9lE7eBfOPHCXOFKBHW1UL+HWDvz9NMv0KXVqsSo= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-74520: iommu/iommufd: Fix IOPF group ownership UAF Date: Sat, 15 Aug 2026 21:26:41 +0900 Message-ID: <2026081544-CVE-2026-74520-7811@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2956; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=px0RMg3vpzY+P6bLjF1B//44hVlKAvGCWtuzfH0kgoc=; b=owGbwMvMwCRo6H6F97bub03G02pJDFkNUSfWXrPi3+iwbeKlZw2GjK5MwsEnXYLfxx71SLXkW qWo7yXTEcvCIMjEICumyPJlG8/R/RWHFL0MbU/DzGFlAhnCwMUpABMJn8qw4BT7nXkHC17fYP3D uUJ2Jeu623pLohjmcNzjFcmOrL6sLeGRX948v+dQhPp3AA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: iommu/iommufd: Fix IOPF group ownership UAF iopf_group_alloc() links each last-page IOPF group into the generic IOPF pending list before invoking the domain fault handler. iommufd_fault_iopf_handler() also queued an accepted group in the IOMMUFD deliver list without removing it from the generic pending list. When detach or HWPT replacement drops the device's IOPF reference count to zero, an IOMMU driver may call iopf_queue_remove_device(). That function responds to and frees groups through the generic pending list without removing the same groups from IOMMUFD's deliver list or response xarray. A later read, response, or cleanup can then access the freed group and cause a UAF. Fix this by dequeuing an accepted group from the generic pending list before IOMMUFD queues it for userspace response. Make iopf_group_response() send a response regardless of pending-list membership, so the dequeued group can still be completed by IOMMUFD. The Linux kernel CVE team has assigned CVE-2026-74520 to this issue. Affected and fixed versions =========================== Issue introduced in 6.11 with commit 34765cbc679c59ea5d952d738d2d16bf4aadc497 and fixed in 6.18.44 with commit 6da8f37419dd4c456f26fc203f04e000186f4b3d Issue introduced in 6.11 with commit 34765cbc679c59ea5d952d738d2d16bf4aadc497 and fixed in 7.1.8 with commit 4e74a369236424114b94cf6a9f5ff9e848b430b4 Issue introduced in 6.11 with commit 34765cbc679c59ea5d952d738d2d16bf4aadc497 and fixed in 7.2-rc6 with commit 738e6f32e61d80b554e37015ecb7bc620b88001c Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-74520 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/iommu/io-pgfault.c drivers/iommu/iommufd/eventq.c include/linux/iommu.h Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/6da8f37419dd4c456f26fc203f04e000186f4b3d https://git.kernel.org/stable/c/4e74a369236424114b94cf6a9f5ff9e848b430b4 https://git.kernel.org/stable/c/738e6f32e61d80b554e37015ecb7bc620b88001c