CVE-2026-74520

A flaw was found in the Linux kernel's IOMMU (Input/Output Memory Management Unit) and IOMMUFD (IOMMU File Descriptor) components. This vulnerability is a Use-After-Free (UAF), which means the system attempts to use memory that has already been released. Specifically, during device detachment or hardware page table replacement, an IOMMU Page Fault (IOPF) group can be freed while still being referenced by other parts of the system. An attacker could potentially exploit this to cause system instability, crashes, or achieve privilege escalation.

This vulnerability is rated as an Important severity because an authenticated local attacker interacting with the kernel's IOMMU file descriptor subsystem can trigger memory corruption, leading to a system crash or potential privilege escalation. Exploitation requires access to IOMMUFD endpoints and hardware that supports input/output page fault handling, which is typically constrained to specialized virtualization or accelerator workloads. Older enterprise kernels lack the affected IOMMUFD fault routing code and are therefore not exposed.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.