What is the CVSS score of CVE-2024-26786?

CVE-2024-26786 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2024-26786?

CVE-2024-26786 in the Linux kernel iommufd subsystem enables local users to trigger denial-of-service conditions through kernel instability, with no public exploit identified at time of analysis.. A patch is available.

How to fix or mitigate CVE-2024-26786?

Within 24 hours, identify all Linux systems with iommufd subsystem enabled and prioritize by criticality (check via 'cat /boot/config-$(uname -r) | grep IOMMUFD' on running systems). Within 7 days, apply Linux kernel security updates from your vendor (Red Hat, Canonical, SUSE, etc.-reference vendor security advisories for CVE-2024-26786-specific patch versions). Within 30 days, validate patch deployment across all identified systems via automated scanning and confirm iommufd functionality remains intact post-patch.

Linux Kernel CVE-2024-26786

HIGH

NULL Pointer Dereference (CWE-476)

2024-04-04 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Denial Of Service Linux Null Pointer Dereference

7.8

CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

5.8 MEDIUM

Error path requires xa_alloc success AND alignment failure (AC:H); primary impact is kernel DoS (A:H); privilege escalation undemonstrated so C:L/I:L.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 04, 2026 - 13:33 vuln.today

v3 (cvss_changed)

Analysis Updated

Aug 04, 2026 - 13:32 vuln.today

v2 (cvss_changed)

Analysis Updated

Aug 04, 2026 - 13:32 vuln.today

v1 (cvss_changed)

Re-analysis Queued

Aug 04, 2026 - 11:23 vuln.today

cvss_changed

Severity Changed

Aug 04, 2026 - 11:23 NVD

MEDIUM HIGH

CVSS changed

Aug 04, 2026 - 11:23 NVD

5.5 (MEDIUM) 7.8 (HIGH)

CVE Published

Apr 04, 2024 - 09:15 cve.org

MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

iommufd: Fix iopt_access_list_id overwrite bug

Syzkaller reported the following WARN_ON: WARNING: CPU: 1 PID: 4738 at drivers/iommu/iommufd/io_pagetable.c:1360

Call Trace: iommufd_access_change_ioas+0x2fe/0x4e0 iommufd_access_destroy_object+0x50/0xb0 iommufd_object_remove+0x2a3/0x490 iommufd_object_destroy_user iommufd_access_destroy+0x71/0xb0 iommufd_test_staccess_release+0x89/0xd0 __fput+0x272/0xb50 __fput_sync+0x4b/0x60 __do_sys_close __se_sys_close __x64_sys_close+0x8b/0x110 do_syscall_x64

The mismatch between the access pointer in the list and the passed-in pointer is resulting from an overwrite of access->iopt_access_list_id, in iopt_add_access(). Called from iommufd_access_change_ioas() when xa_alloc() succeeds but iopt_calculate_iova_alignment() fails.

Add a new_id in iopt_add_access() and only update iopt_access_list_id when returning successfully.

AnalysisAI

State corruption in the Linux kernel iommufd subsystem (io_pagetable.c) allows a local low-privileged attacker to trigger a kernel WARN_ON leading to system instability or denial of service. The bug manifests in iopt_add_access() when xa_alloc() succeeds but iopt_calculate_iova_alignment() subsequently fails - the function overwrites access->iopt_access_list_id with the newly allocated XArray ID rather than rolling back cleanly, causing a pointer mismatch detected at line 1360 of io_pagetable.c. Discovered via Syzkaller fuzzing; no public exploit code exists and EPSS sits at 0.22% (13th percentile), indicating low real-world exploitation probability at time of analysis.

Technical ContextAI

The iommufd subsystem (drivers/iommu/iommufd/) is the Linux kernel's modern interface for managing I/O memory management units, primarily used in virtualization and device passthrough scenarios (e.g., VFIO/IOMMU device assignment to VMs). The CWE-476 tag (NULL Pointer Dereference) is a secondary consequence - the root cause is a state-consistency bug: iopt_add_access() allocates a slot via xa_alloc() then unconditionally writes the new ID into access->iopt_access_list_id before iopt_calculate_iova_alignment() confirms success. If alignment calculation fails, xa_alloc()'s slot is freed but the ID field is already overwritten, leaving the structure in an inconsistent state. On subsequent iommufd_access_change_ioas() or iommufd_access_destroy_object() calls, the mismatch between the list pointer and the passed-in pointer trips a WARN_ON assertion. Affected CPEs confirm this spans linux_kernel up through 6.8-rc6.

RemediationAI

Apply the upstream kernel patch available via the three stable-branch commits referenced in NVD: https://git.kernel.org/stable/c/9526a46cc0c378d381560279bea9aa34c84298a0, https://git.kernel.org/stable/c/aeb004c0cd6958e910123a1607634401009c9539, and https://git.kernel.org/stable/c/f1fb745ee0a6fe43f1d84ec369c7e6af2310fda9. Distribution vendors (Red Hat, Canonical, SUSE, Debian) should be consulted for their respective kernel errata. If patching is not immediately possible and iommufd is not required, restricting access to iommufd device nodes (typically /dev/iommu) via filesystem permissions or seccomp policies reduces the attack surface. Disabling VFIO and IOMMU passthrough at the hypervisor level is an effective workaround for environments that do not use device passthrough, at the cost of losing hardware-accelerated I/O virtualization. No exact patched release version is independently confirmed beyond the commit-level references.