CVE-2026-74380

A flaw was found in the Linux kernel's host1x GPU driver. An incorrect return value check in the iommu_map_sgtable() function, coupled with an improper integer assignment in pin_job(), could lead to negative value overflows. This vulnerability may result in data integrity issues or system instability within the GPU memory management subsystem.

A low impact flaw was found in the Linux kernel host1x GPU driver, affecting the kernel and kernel-rt packages in Red Hat Enterprise Linux 9 and 10 as well as the kernel and kernel-ivos-qualcomm packages in Red Hat In-Vehicle OS 2. After the IOMMU API changed iommu_map_sgtable() to return an ssize_t with negative error codes, pin_job() stored that return value in an int and did not check it for errors, so negative values could overflow. A local user with low privileges who can reach the host1x GPU job submission interface could trigger a job whose scatter-gather table fails to map; because the failure is treated as success, job setup can continue with an unmapped IOVA, leading to IOMMU faults or device job failure. The impact is limited to availability of the GPU driver path (Red Hat CVSS 5.5: AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), with no supported evidence of privilege escalation, arbitrary write, or information disclosure. Red Hat Enterprise Linux 6, 7, and 8 do not contain the vulnerable code and are not affected. Because the issue is rated low impact and is not remotely exploitable, the fix is deferred to a future update of the affected products; the residual risk is local denial of service limited to the GPU subsystem. The upstream CVEORG severity of 8.8 (IMPORTANT) is higher than the Red Hat rating because its vector assumes scope change with high confidentiality and integrity impacts, which the available evidence does not support.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.