Bug 2517030 (CVE-2026-74520)

Summary: CVE-2026-74520 kernel: iommu/iommufd: Fix IOPF group ownership UAF
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Linux kernel's IOMMU (Input/Output Memory Management Unit) and IOMMUFD (IOMMU File Descriptor) components. This vulnerability is a Use-After-Free (UAF), which means the system attempts to use memory that has already been released. Specifically, during device detachment or hardware page table replacement, an IOMMU Page Fault (IOPF) group can be freed while still being referenced by other parts of the system. An attacker could potentially exploit this to cause system instability, crashes, or achieve privilege escalation.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-15 12:45:31 UTC 
In the Linux kernel, the following vulnerability has been resolved:

iommu/iommufd: Fix IOPF group ownership UAF

iopf_group_alloc() links each last-page IOPF group into the generic IOPF
pending list before invoking the domain fault handler.
iommufd_fault_iopf_handler() also queued an accepted group in the
IOMMUFD deliver list without removing it from the generic pending list.

When detach or HWPT replacement drops the device's IOPF reference count
to zero, an IOMMU driver may call iopf_queue_remove_device(). That
function responds to and frees groups through the generic pending list
without removing the same groups from IOMMUFD's deliver list or response
xarray. A later read, response, or cleanup can then access the freed
group and cause a UAF.

Fix this by dequeuing an accepted group from the generic pending list
before IOMMUFD queues it for userspace response.
Make iopf_group_response() send a response regardless of pending-list
membership, so the dequeued group can still be completed by IOMMUFD.
Comment 1 Mauro Matteo Cascella 2026-08-19 19:26:59 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026081544-CVE-2026-74520-7811@gregkh/T