CVE-2026-74573: iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE
In the Linux kernel, the following vulnerability has been resolved:
iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE
armvsmmuvsidtosid() maps a guest's vSID to a single physical Stream ID taken from master->streams[0], assuming a device has exactly one stream. A device with several streams gets only its first one mapped, so a guest vSID invalidation cannot reach the others' ATC and IOTLB entries; a device with none makes master->streams a ZEROSIZEPTR, read out of bounds.
Add an armvsmmuvdeviceinit() op to reject the vDEVICE with -EOPNOTSUPP when master->numstreams is not one, rather than mapping it silently.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74573?
CVE-2026-74573 has a risk rating of 34.
What does CVE-2026-74573 affect?
CVE-2026-74573 affects the Linux kernel's IOMMU ARM-SMMU-v3 IOMMU driver.
How do I fix CVE-2026-74573?
To fix CVE-2026-74573, update your Linux kernel to the latest stable version that addresses this vulnerability.
What happens if CVE-2026-74573 is exploited?
Exploiting CVE-2026-74573 may lead to improper handling of Stream IDs in virtual devices, potentially causing system instability.
Is CVE-2026-74573 specific to any version of the Linux kernel?
Yes, CVE-2026-74573 applies to certain versions of the Linux kernel that implement the ARM-SMMU-v3 IOMMU driver.