EUVD-2026-76358
GHSA-g6rr-fv4f-cc2j
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Local access required; triggering probe failure non-trivially raises AC:H; local user needed (PR:L), not truly unauthenticated as NVD suggests.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
iommu/msm: Unwind probe state on registration failure
msm_iommu_probe() adds its devm-managed IOMMU object to qcom_iommu_devices before adding the IOMMU sysfs device and registering it with the IOMMU core.
If iommu_device_sysfs_add() fails, probe returns with the object still on qcom_iommu_devices. The driver core then releases the devm allocation, leaving a dangling list entry that later list walks may dereference.
If iommu_device_register() fails, the same dangling list entry remains and the sysfs device is left registered as well.
Unwind the sysfs device and global list entry in reverse setup order on the corresponding failure paths.
AnalysisAI
Dangling pointer vulnerability in the Linux kernel's Qualcomm MSM IOMMU driver (iommu/msm) can lead to kernel memory corruption on systems running Qualcomm MSM/Snapdragon SoCs. The msm_iommu_probe() function registers its devm-managed IOMMU object in the global qcom_iommu_devices list prior to completing sysfs and IOMMU core registration; if either iommu_device_sysfs_add() or iommu_device_register() fails, the devm framework releases the backing memory while the stale list entry remains, producing a dangling pointer that subsequent kernel list walks may dereference. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local access to a system running Qualcomm MSM/Snapdragon hardware with the iommu/msm driver loaded. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The supplied CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H scores 8.4 and warrants scrutiny. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is upgrading to Linux kernel 6.18.50 or 7.2.4 (or mainline 7.3-rc1), which contain the corrected error-unwinding logic that removes the IOMMU object from qcom_iommu_devices and cleans up the sysfs entry in reverse order on the failure paths. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running Linux kernels earlier than version 6.18.50 or 7.2.4 that use Qualcomm MSM or Snapdragon SoCs. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today