Skip to main content

Linux Kernel CVE-2026-74520

| EUVDEUVD-2026-59713 HIGH
2026-08-15 Linux GHSA-9qch-cxwm-9cjc
Information Disclosure Linux Red Hat Suse
8.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Race-condition UAF warrants AC:H over the filed AC:L; S:C retained for IOMMU boundary crossing with potential hypervisor-layer impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
SUSE
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat
7.0 HIGH
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 12:07 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
8.8 (HIGH)
Patch available
Aug 15, 2026 - 13:04 EUVD
CVE Published
Aug 15, 2026 - 12:27 cve.org
HIGH 8.8
CVE Published
Aug 15, 2026 - 12:27 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

iommu/iommufd: Fix IOPF group ownership UAF

iopf_group_alloc() links each last-page IOPF group into the generic IOPF pending list before invoking the domain fault handler. iommufd_fault_iopf_handler() also queued an accepted group in the IOMMUFD deliver list without removing it from the generic pending list.

When detach or HWPT replacement drops the device's IOPF reference count to zero, an IOMMU driver may call iopf_queue_remove_device(). That function responds to and frees groups through the generic pending list without removing the same groups from IOMMUFD's deliver list or response xarray. A later read, response, or cleanup can then access the freed group and cause a UAF.

Fix this by dequeuing an accepted group from the generic pending list before IOMMUFD queues it for userspace response. Make iopf_group_response() send a response regardless of pending-list membership, so the dequeued group can still be completed by IOMMUFD.

AnalysisAI

Use-after-free in the Linux kernel's IOMMUFD subsystem (iommu/iommufd) exposes systems running VFIO device passthrough to kernel memory corruption by a local low-privileged attacker, with a scope change that may cross security boundaries into the hypervisor layer. The flaw, present since Linux 6.11, stems from a race between IOPF group acceptance by the fault handler and concurrent device detach operations, leaving IOMMUFD's deliver list holding references to memory already freed by the generic pending list cleanup path. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
Gain low-privilege local access
Delivery
Identify active IOMMUFD VFIO passthrough device
Exploit
Submit IOPF fault to trigger group acceptance
Install
Race concurrent device detach operation
C2
iopf_queue_remove_device() frees IOPF group
Execute
Dereference freed group via IOMMUFD deliver list
Impact
Achieve kernel UAF for privilege escalation
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a local attacker with low-privilege credentials (AV:L, PR:L per the provided CVSS vector) on a Linux system running kernel 6.11 or later. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 score of 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) signals high severity, but the attack surface is materially narrowed by the requirement for active IOMMUFD device passthrough and a successful timing of a concurrent device detach race. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario A local attacker with a low-privilege account on a virtualization host running an affected Linux kernel triggers an I/O Page Fault sequence via a VFIO-passthrough device, causing iommufd_fault_iopf_handler() to accept and queue an IOPF group in both the generic pending list and IOMMUFD's deliver list simultaneously. A concurrent device detach operation races this handler and causes iopf_queue_remove_device() to free the group through the pending list; the attacker then triggers a response or read operation that dereferences the freed group pointer still held in IOMMUFD's deliver list or response xarray, achieving kernel Use-After-Free. …
Remediation The primary fix is to upgrade to a patched kernel: Linux 6.18.44, Linux 7.1.8, or any mainline build incorporating commit 738e6f32e61d80b554e37015ecb7bc620b88001c. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Inventory all hypervisors running Linux 6.11 or later that use VFIO device passthrough; prioritize systems supporting critical or multi-tenant workloads. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-74520 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy