What is the CVSS score of EUVD-2026-59424?

EUVD-2026-59424 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by EUVD-2026-59424?

CVE-2026-74277 is a Linux kernel memory corruption vulnerability in the iommu/dma-iommu subsystem exploitable by low-privilege local users to corrupt DMA mappings, with no public exploit identified…. A patch is available.

How to fix or mitigate EUVD-2026-59424?

Within 24 hours, identify all Linux systems running affected kernel versions with P2PDMA or PCI device passthrough enabled using your asset management and vulnerability scanning tools; prioritize virtualization hosts, database servers, and systems with direct hardware access. Within 7 days, apply the available vendor patch to affected systems in test environments first to validate stability and confirm PCI/DMA functionality post-patch, then stage deployment to non-critical production systems. Within 30 days, complete kernel patch deployment across all affected Linux production systems, verify system functionality and performance, and ensure monitoring is active for any kernel panic or memory corruption events.

Linux Kernel EUVD-2026-59424

| CVE-2026-74277 HIGH

2026-08-15 Linux

GHSA-v74x-xvfc-h3j3

Information Disclosure Linux Red Hat

8.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

8.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

AC raised to H because exploitation requires specific P2PDMA-capable PCIe hardware, IOMMU active, and a multi-segment scatterlist condition not present in standard deployments.

3.1 AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 10:08 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

8.8 (HIGH)

Patch available

Aug 15, 2026 - 07:20 EUVD

CVE Published

Aug 15, 2026 - 05:57 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 15, 2026 - 05:57 cve.org

HIGH 8.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path

In iommu_dma_map_sg(), when handling PCI P2PDMA cases, the DMA length of the current scatterlist segment s is incorrectly assigned from the head entry sg->length instead of the current entry s->length.

This typo causes all P2PDMA segments in the scatterlist to inherit the length of the first segment, leading to corrupted DMA lengths for multi- segment scatterlists.

Fix this by using s->length instead of sg->length.

AnalysisAI

Corrupted DMA length assignments in the Linux kernel's iommu/dma-iommu subsystem allow a local attacker with low privileges to trigger memory corruption through the PCI Peer-to-Peer DMA (P2PDMA) code path, potentially achieving confidentiality, integrity, and availability impact across scope boundaries. The flaw stems from a variable typo in iommu_dma_map_sg() where multi-segment P2PDMA scatterlists receive the head segment's length for all entries, corrupting DMA mappings and leading to out-of-bounds memory operations. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon

Gain local system access (PR:L)

Delivery

Initiate I/O through P2PDMA-capable PCIe device

Exploit

Kernel invokes iommu_dma_map_sg() with multi-segment scatterlist

Install

All segments inherit first segment's length due to typo

Corrupted DMA mappings issued to PCIe device

Execute

Device performs out-of-bounds memory read or write

Impact

Kernel memory disclosure or data corruption

Recon

Gain local system access (PR:L)

Delivery

Initiate I/O through P2PDMA-capable PCIe device

Exploit

Kernel invokes iommu_dma_map_sg() with multi-segment scatterlist

Install

All segments inherit first segment's length due to typo

Corrupted DMA mappings issued to PCIe device

Execute

Device performs out-of-bounds memory read or write

Impact

Kernel memory disclosure or data corruption

Vulnerability AssessmentAI

Exploitation	Exploitation requires all of the following: (1) a Linux kernel version containing the vulnerable iommu_dma_map_sg() P2PDMA path (between commit a25e7962db0d and the fix commits); (2) an IOMMU enabled and actively managing DMA for PCIe devices (IOMMU=on in kernel configuration and firmware); (3) PCIe hardware capable of Peer-to-Peer DMA - such as NVMe SSDs or GPUs supporting GPU-Direct Storage or NVMe-over-Fabrics P2PDMA; (4) a DMA operation that produces a multi-segment scatterlist (single-segment P2PDMA transfers are not affected by the length-overwrite bug); and (5) local access with at minimum unprivileged filesystem or device I/O capability (PR:L per CVSS). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The NVD-assigned CVSS 3.1 score of 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) reflects the worst-case potential impact of corrupted DMA operations - kernel memory corruption with scope change - but overstates realistic exploitation ease. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker with local access (PR:L) on a server equipped with PCIe P2PDMA-capable hardware - such as a high-performance storage or compute node with NVMe-oF or GPU-Direct Storage configured - initiates a DMA operation that produces a multi-segment scatterlist traversing the P2PDMA path in iommu_dma_map_sg(). The kernel assigns incorrect lengths to all segments after the first, causing the PCIe device to DMA-read or DMA-write memory at incorrect offsets, potentially exposing sensitive kernel memory regions or overwriting adjacent data structures. …
Remediation	The primary fix is to update to a patched Linux kernel. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, identify all Linux systems running affected kernel versions with P2PDMA or PCI device passthrough enabled using your asset management and vulnerability scanning tools; prioritize virtualization hosts, database servers, and systems with direct hardware access. …

Threat intelligence, references, and detailed analysis are available after sign-in.