Linux Kernel CVE-2026-74328

Exploitation requires local code execution with at least low privilege (confirmed by CVSS PR:L) on a Linux host where the iommufd framework is active - specifically, a system with IOMMU enabled in firmware (Intel VT-d or AMD-Vi) and at least one device configured for passthrough via VFIO, vDPA, or a similar dmabuf-sharing mechanism. Standard Linux servers, desktops, or containers without device passthrough configured do not exercise the iommufd-dmabuf code path and are not exposed. The race condition additionally depends on concurrent scheduling of dmabuf invalidation callbacks during the detach window, meaning exploitation is timing-dependent and not deterministically reproducible without kernel internals knowledge. What limits exploitation: the local attack vector eliminates remote unauthenticated exploitation, the race window introduces practical reliability constraints, and the non-default requirement for IOMMU device passthrough significantly narrows the exposed population relative to the full Linux kernel install base.

The CVSS 8.8 with Changed Scope signals that successful exploitation may breach IOMMU isolation boundaries and affect co-resident workloads or VMs - a serious concern for cloud and virtualization providers. However, this severity must be balanced against the AV:L (local) attack vector, which restricts exploitation to actors already with code execution on the host, and the race-condition nature of the flaw, which makes reliable triggering non-trivial and is reflected in the AC:L assignment that arguably understates practical complexity. The EPSS of 0.15% at the 5th percentile strongly corroborates low real-world exploitation activity and conflicts with the elevated CVSS; the gap is best explained by the local-only, timing-dependent nature of the flaw. The absence of a CISA KEV entry confirms no confirmed active exploitation. Even a mid-sized municipal IT team in tczew operating Linux-based KVM virtualization infrastructure should treat patching as moderate-urgency for general hosts but high-urgency for shared-tenant or GPU-passthrough environments where cross-VM data exposure is a concrete risk. Patch availability from upstream kernel.org substantially reduces residual risk for teams on current stable kernel branches.

A low-privileged local attacker on a KVM virtualization host with GPU or NIC passthrough configured initiates a carefully timed sequence of concurrent dmabuf operations - triggering an invalidation callback to fire precisely while the iommufd subsystem is mid-teardown, after the pages mutex has been freed but before the dmabuf detach completes. The resulting use-after-free corrupts kernel memory in a manner that may enable privilege escalation within the host kernel or leak memory contents from co-resident VMs sharing IOMMU domains. No public POC is known at time of analysis.