CVE-2026-74380: gpu: host1x: Fix iommu_map_sgtable() return value check
In the Linux kernel, the following vulnerability has been resolved:
gpu: host1x: Fix iommumapsgtable() return value check
Commit "iommu: return full error code from iommumapsgatomic" changed iommumapsgtable() to return an ssizet and negative values in error cases, rather than a sizet and a zero.
pinjob() also was incorrectly assigning to 'int', which could cause overflows into negative values.
Update pinjob() to correctly check for errors from iommumapsgtable.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Apply the fix described: update iommu_map_sgtable() to return an ssize_t and use negative values for error cases, and update pin_job() to correctly check the return value from iommu_map_sgtable(). Ensure pin_job() does not incorrectly store the return value in an int such that zero/overflow could mis-handle errors.
Linux kernel (iommu_map_sgtable / gpu: host1x) iommu_map_sgtable() return type/behavior = Return ssize_t with negative error values (instead of size_t with zero)