SB20260815124 - Out-of-bounds write in Linux kernel iommu intel driver

Description

This security bulletin contains information about 1 vulnerability.

1) Out-of-bounds write (CVE-ID: CVE-2026-74355)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to memory corruption in the intel vt-d iommu device RB-tree handling when probing a device and executing the probe error path for a device that does not support ATS. A local user can trigger a device probe failure to corrupt the device RB-tree and cause a denial of service.

The issue occurs because a zero-initialized RB-tree node may be treated as a tree root during removal if insertion was skipped.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/43bd9e6d5513cb1edbafdeef146a1edc3aaced56
• https://git.kernel.org/stable/c/d16923a45d4d08367650fdc3451c89299ab6ac5a
• https://git.kernel.org/stable/c/f5102e0fc3c6dc8685549891a96e4589fdb3e211