Linux Kernel CVE-2026-74520

Exploitation requires a local attacker with low-privilege credentials (AV:L, PR:L per the provided CVSS vector) on a Linux system running kernel 6.11 or later. The vulnerable code path is only reachable when IOMMUFD is actively in use with at least one device configured for I/O Page Fault handling - a configuration that occurs specifically in VFIO-based PCIe device passthrough environments such as GPU or NIC passthrough to virtual machines. The race condition further requires a concurrent device detach or HWPT replacement operation to fire while the IOPF group is simultaneously being processed by the fault handler, introducing a timing dependency. Factors that limit exploitation: local-only access vector (not remotely triggerable), requirement for low-privilege credentials, mandatory IOMMUFD-with-IOPF configuration that is absent in standard Linux deployments not using device passthrough, and a race window that demands precise timing. Systems not running IOMMUFD device passthrough are entirely unexposed to this code path regardless of kernel version.

The CVSS 3.1 score of 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) signals high severity, but the attack surface is materially narrowed by the requirement for active IOMMUFD device passthrough and a successful timing of a concurrent device detach race. The EPSS score of 0.17% (6th percentile) reflects negligible current exploitation activity, consistent with the absence of a KEV listing or any public proof-of-concept code. In practice, this is a high-priority patch target for any organization running VFIO-based PCIe passthrough - even a mid-sized municipal IT team in kielce operating VM clusters with active device passthrough would face meaningful kernel exposure on unpatched kernels in the 6.11-6.18.43 or 7.0-7.1.7 range. Standard Linux deployments without IOMMUFD actively configured are not exposed to this code path despite the high CVSS score, making the raw score an overestimate of real-world population risk. The race-condition dependency makes reliable exploitation technically demanding and explains the low EPSS; however, a successful UAF in kernel IOMMU code can yield powerful memory primitives with scope-change impact, warranting prompt patching wherever device passthrough is in use.

A local attacker with a low-privilege account on a virtualization host running an affected Linux kernel triggers an I/O Page Fault sequence via a VFIO-passthrough device, causing iommufd_fault_iopf_handler() to accept and queue an IOPF group in both the generic pending list and IOMMUFD's deliver list simultaneously. A concurrent device detach operation races this handler and causes iopf_queue_remove_device() to free the group through the pending list; the attacker then triggers a response or read operation that dereferences the freed group pointer still held in IOMMUFD's deliver list or response xarray, achieving kernel Use-After-Free. No public proof-of-concept exists at time of analysis, making reliable exploitation difficult without substantial kernel exploit development expertise.