CVE-2026-74355

A flaw was found in the Linux kernel's iommu/vt-d component. This vulnerability occurs when the info->node RB-tree member is zero-initialized, and a device that does not support Address Translation Services (ATS) skips the device_rbtree_insert() call. If a subsequent probe step fails, the error path incorrectly attempts to remove a zeroed node, misinterpreting it as a tree root. This misinterpretation leads to corruption of the device RB-tree, which can result in system instability or a denial of service.

A moderate severity flaw was found in the Linux kernel's Intel VT-d IOMMU driver (iommu/vt-d). The info->node RB-tree member is zero-initialized via kzalloc; when a device does not support Address Translation Services (ATS), device_rbtree_insert() is skipped, and if a subsequent device probe step fails, the error path calls device_rbtree_remove(), which misinterprets the zeroed node as a tree root and corrupts the IOMMU device RB-tree. Exploitation requires local privileged access on an Intel VT-d platform together with specific conditions (a device without ATS whose probe fails), and the verified consequence is corruption of kernel data structures leading to system instability or a denial of service. Red Hat rated this flaw Moderate (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), which is lower than the upstream CVE.org Important rating of 8.2, because the issue is local, requires privileges, and primarily affects system availability rather than confidentiality or integrity. Red Hat Enterprise Linux 9 and 10 streams that contain the vulnerable code (RHEL 9.8.z, RHEL 9.9, RHEL 10.2.z, and RHEL 10.3 kernel and kernel-rt, and Red Hat In-Vehicle OS 2.0 and 2.1 kernels) are affected; the fix for these streams is currently deferred to a future update, so the residual risk remains a local denial of service on affected systems. Earlier RHEL 6, 7, 8, and earlier RHEL 9 and 10 update streams do not contain the vulnerable code and are therefore not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.