What is the CVSS score of CVE-2026-74573?

CVE-2026-74573 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-74573?

CVE-2026-74573 is a critical out-of-bounds kernel memory vulnerability affecting Linux hosts on ARM64 with SMMUv3 IOMMU nested virtualization, potentially compromising hypervisor isolation and all…. A patch is available.

How to fix or mitigate CVE-2026-74573?

Within 24 hours: verify whether your infrastructure includes ARM64 hosts with SMMUv3 IOMMU and iommufd nested-device support; if absent, no action needed. Within 7 days: for affected hosts, obtain the vendor-released patch from your Linux distribution or hypervisor vendor (kernel update required) and validate in pre-production ARM64 nested-virtualization test environment. Within 30 days: deploy kernel patch across all production ARM64 systems using SMMUv3 with nested device assignment, prioritizing systems hosting untrusted guest workloads.

Linux Kernel CVE-2026-74573

EUVD-2026-59638 CRITICAL

2026-08-15 Linux

GHSA-p5wj-hqvh-c7x4

Information Disclosure Linux Red Hat Suse

9.3

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

9.3 CRITICAL

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Requires local guest access plus a specific nested-SMMUv3 vDEVICE with a non-single-stream device (AC:H, PR:L); primary impact is an out-of-bounds kernel read (C:H) crossing to the host (S:C), with limited integrity/availability effect.

3.1 AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:L/SI:N/SA:N

SUSE

8.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Red Hat

7.0 HIGH

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 12:33 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

9.3 (CRITICAL)

Patch available

Aug 15, 2026 - 13:04 EUVD

CVE Published

Aug 15, 2026 - 12:28 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 15, 2026 - 12:28 cve.org

CRITICAL 9.3

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE

arm_vsmmu_vsid_to_sid() maps a guest's vSID to a single physical Stream ID taken from master->streams[0], assuming a device has exactly one stream. A device with several streams gets only its first one mapped, so a guest vSID invalidation cannot reach the others' ATC and IOTLB entries; a device with none makes master->streams a ZERO_SIZE_PTR, read out of bounds.

Add an arm_vsmmu_vdevice_init() op to reject the vDEVICE with -EOPNOTSUPP when master->num_streams is not one, rather than mapping it silently.

AnalysisAI

Out-of-bounds kernel memory read and incomplete invalidation affect the Linux kernel's ARM SMMUv3 iommufd nested-virtualization path (arm_vsmmu_vsid_to_sid), where a guest virtual Stream ID is mapped to a single physical Stream ID from master->streams[0]. On ARM64 hosts using nested SMMUv3 with iommufd vDEVICE, assigning a device that has zero streams turns master->streams into a ZERO_SIZE_PTR that is read out of bounds, while a device with multiple streams leaves the other streams' ATC/IOTLB entries unreachable by guest invalidations. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Gain guest control on nested SMMUv3 host

Delivery

Assign device with zero or multiple Stream IDs to vDEVICE

Exploit

Issue guest vSID invalidation command

Execution

Trigger ZERO_SIZE_PTR out-of-bounds read in arm_vsmmu_vsid_to_sid

Impact

Disclose adjacent host kernel memory or leave stale IOTLB entries

Access

Gain guest control on nested SMMUv3 host

Delivery

Assign device with zero or multiple Stream IDs to vDEVICE

Exploit

Issue guest vSID invalidation command

Execution

Trigger ZERO_SIZE_PTR out-of-bounds read in arm_vsmmu_vsid_to_sid

Impact

Disclose adjacent host kernel memory or leave stale IOTLB entries

Vulnerability AssessmentAI

Exploitation	Exploitation requires an ARM64 host with an SMMUv3 IOMMU running iommufd-based nested virtualization (vSMMU) and a vDEVICE object bound to a physical device whose master->num_streams is not exactly one - specifically zero streams (which makes master->streams a ZERO_SIZE_PTR and yields the out-of-bounds read) or more than one stream (which yields incomplete ATC/IOTLB invalidation). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The signals are mixed and should temper the headline 9.3 score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	On an ARM64 host offering nested SMMUv3 device passthrough, an operator or guest assigns a device with zero (or multiple) Stream IDs to an iommufd vDEVICE; when the guest issues a vSID-to-SID invalidation, arm_vsmmu_vsid_to_sid() dereferences a ZERO_SIZE_PTR and reads adjacent kernel memory, potentially disclosing host data across the virtualization boundary or leaving stale ATC/IOTLB entries. No public exploit exists, and the local attack vector plus the requirement for a specific vDEVICE/stream configuration make this a targeted, hard-to-reach condition rather than a mass-exploitable flaw.
Remediation	Upstream fix available (PR/commit); released patched version not independently confirmed - apply the kernel update containing stable commits 3808bab5d95ae79e333e11f6a73d178e084c645d, 0acbc621341aca4eb94d9c2f43e1ab273ff088f0, or c3b8ee84a965058b41275069d4696f37a8b14bf6 (https://git.kernel.org/stable/c/3808bab5d95ae79e333e11f6a73d178e084c645d), which add arm_vsmmu_vdevice_init() to reject non-single-stream vDEVICEs; per EUVD the fix lands in stable series around 6.18.44 and mainline 7.2-rc6, so track your distribution's backport advisory rather than an invented version. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: verify whether your infrastructure includes ARM64 hosts with SMMUv3 IOMMU and iommufd nested-device support; if absent, no action needed. …

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-74573 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-74573

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code