What is the CVSS score of CVE-2026-74355?

CVE-2026-74355 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-74355?

Linux kernel iommu/vt-d driver vulnerability (CVE-2026-74355, CVSS 8.2) enables privilege escalation in virtualized environments.. A patch is available.

How to fix or mitigate CVE-2026-74355?

Within 24 hours, identify and catalog all Linux systems with Intel VT-d IOMMU enabled and document currently running kernel versions. Within 7 days, obtain and test kernel patches (versions 6.18.40, 7.1.5, 7.2-rc1, or later as appropriate) in development and staging environments to verify stability and application compatibility. Within 30 days, deploy patched kernels to all production systems and confirm successful installation across infrastructure.

Linux Kernel CVE-2026-74355

EUVD-2026-59502 HIGH

2026-08-15 Linux

GHSA-444c-98p8-5jq5

Information Disclosure Linux Red Hat

8.2

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

8.2 HIGH

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

7.4 HIGH

Requires high privileges and specific hardware conditions (non-ATS device + probe failure), justifying AC:H and PR:H; confidentiality impact is incidental to primary integrity and availability corruption.

3.1 AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:H/SI:H/SA:H

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 10:44 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

8.2 (HIGH)

Patch available

Aug 15, 2026 - 07:19 EUVD

CVE Published

Aug 15, 2026 - 05:58 cve.org

HIGH 8.2

CVE Published

Aug 15, 2026 - 05:58 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

iommu/vt-d: Fix RB-tree corruption in probe error path

The info->node RB-tree member is zero-initialized via kzalloc. If a device does not support ATS, the device_rbtree_insert() call is skipped. If a subsequent probe step fails, the error path jumps to device_rbtree_remove(), which misinterprets the zeroed node as a tree root and corrupts the device RB-tree.

Fix this by explicitly initializing the RB-node as empty using RB_CLEAR_NODE() during initialization and guarding the removal with RB_EMPTY_NODE().

AnalysisAI

RB-tree corruption in the Linux kernel iommu/vt-d driver allows a privileged local attacker to corrupt kernel memory structures during device probe error handling, leading to potential kernel panic, privilege escalation, or information disclosure. Affected systems must have Intel VT-d IOMMU enabled and encounter a device that does not support Address Translation Services (ATS) followed by a probe step failure. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Gain kernel/root access on VT-d-enabled host

Delivery

Attach or enumerate non-ATS PCI device

Exploit

Trigger probe failure after insert skip

Execution

Error path corrupts device RB-tree

Persist

Leverage kernel heap corruption

Impact

Crash system or escalate privileges

Access

Gain kernel/root access on VT-d-enabled host

Delivery

Attach or enumerate non-ATS PCI device

Exploit

Trigger probe failure after insert skip

Execution

Error path corrupts device RB-tree

Persist

Leverage kernel heap corruption

Impact

Crash system or escalate privileges

Vulnerability AssessmentAI

Exploitation	Exploitation requires all of the following concurrent conditions: (1) The target system must have Intel VT-d IOMMU enabled in firmware and the Linux kernel must have CONFIG_INTEL_IOMMU compiled in; (2) A PCI device that does not support ATS (PCIe Address Translation Services) must be present and enumerated during kernel probe - this is not configurable by the user but is a hardware property; (3) A subsequent step in the device probe sequence must fail after device_rbtree_insert() was skipped, triggering the error cleanup path - the specific failing step is not named in the description, meaning the exact trigger may vary by platform and kernel configuration; (4) The attacker must have kernel-level or root-equivalent access (CVSS PR:H) to interact with or influence IOMMU device initialization, such as loading a kernel module, triggering hotplug, or operating in a guest with PCIe passthrough privileges. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The official CVSS 3.1 score of 8.2 (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) overstates real-world risk in several dimensions. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker with root or kernel-module loading privileges on a VT-d-enabled host deliberately or opportunistically triggers a probe of a PCI device that does not advertise ATS capability, followed by engineering or awaiting a failure in a subsequent probe step (e.g., via a malformed or non-compliant PCIe device in a passthrough scenario). The iommu/vt-d error path then calls device_rbtree_remove() on the zero-initialized, never-inserted node, corrupting the shared device RB-tree. …
Remediation	The primary fix is to upgrade to a patched Linux kernel version: 6.18.40, 7.1.5, or 7.2-rc1, which incorporate the RB_CLEAR_NODE() initialization guard and the RB_EMPTY_NODE() check in the device probe error path. … Detailed patch versions, workarounds, and compensating controls in full report.