SB20260816191 - Use-after-free in Linux kernel IOMMUFD IOPF group handling logic

Description

This security bulletin contains information about 1 vulnerability.

1) Use-after-free (CVE-ID: CVE-2026-74520)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the IOMMUFD IOPF group handling logic when processing page fault groups during device detach or HWPT replacement. A local user can trigger fault handling and later access a freed group to cause a denial of service.

The issue occurs because an accepted group can remain referenced by the IOMMUFD deliver list or response xarray after being freed through the generic pending list.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/4e74a369236424114b94cf6a9f5ff9e848b430b4
• https://git.kernel.org/stable/c/6da8f37419dd4c456f26fc203f04e000186f4b3d
• https://git.kernel.org/stable/c/738e6f32e61d80b554e37015ecb7bc620b88001c