CVE-2026-74380 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
gpu: host1x: Fix iommu_map_sgtable() return value check
Commit "iommu: return full error code from iommu_map_sg[_atomic]()"
changed iommu_map_sgtable() to return an ssize_t and negative values in error cases, rather than a size_t and a zero.
pin_job() also was incorrectly assigning to 'int', which could cause overflows into negative values.
Update pin_job() to correctly check for errors from iommu_map_sgtable.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability resides in the linux kernel's gpu host1x subsystem where an improper error handling mechanism exists in the iommu_map_sgtable() function. This issue stems from a commit that modified the iommu_map_sgtable() function to return ssize_t values instead of size_t, with negative values indicating error conditions rather than zero. The change was intended to provide more precise error reporting but introduced a critical flaw in how error codes are processed within the pin_job() function. When iommu_map_sgtable() returns negative error codes, these values are incorrectly assigned to integer variables that cannot properly represent negative values, leading to potential overflow conditions where error codes become positive integers and are misinterpreted as successful operations.
The technical flaw manifests in the pin_job() function which was originally designed to handle unsigned size_t return values but now receives ssize_t values including negative error codes. This mismatch occurs because the function declares its return value storage as int type rather than ssize_t, creating a type conversion issue that allows negative error indicators to be converted into positive integers. The vulnerability represents a classic case of improper error handling and type casting that can lead to silent failures where error conditions are incorrectly treated as successful operations. This type of flaw falls under CWE-704 - Incorrect Type Conversion or Cast, which specifically addresses situations where type conversions result in loss of information or incorrect interpretation of values.
The operational impact of this vulnerability extends beyond simple functional failure to potentially compromise system security and stability. When error codes are misinterpreted due to improper type handling, the gpu subsystem may continue processing with invalid memory mappings or fail to properly report critical failures during memory allocation operations. This could result in memory corruption, privilege escalation opportunities, or denial of service conditions where gpu operations proceed with incorrect assumptions about memory mapping success. The vulnerability affects systems utilizing host1x gpu drivers with iommu support and is particularly concerning in embedded systems or devices where gpu memory management directly impacts system stability and security boundaries.
Mitigation strategies should focus on correcting the type handling within the pin_job() function to properly accommodate ssize_t return values from iommu_map_sgtable(). The fix requires updating the variable declarations to use appropriate signed integer types that can correctly represent both positive success values and negative error codes. Additionally, comprehensive error checking mechanisms must be implemented to ensure all return values from iommu_map_sgtable() are properly validated before proceeding with subsequent operations. System administrators should apply kernel patches that address this specific type conversion issue and verify that gpu subsystems operate with proper error reporting enabled. The ATT&CK framework would categorize this vulnerability under T1068 - Exploitation for Privilege Escalation and T1499 - Endpoint Termination, as the improper error handling could enable attackers to manipulate memory operations and potentially escalate privileges through gpu subsystem exploitation.
This vulnerability demonstrates the critical importance of maintaining proper type consistency in kernel code where error handling and return value processing directly impact system security. The fix must ensure that all error conditions are properly propagated and handled throughout the gpu memory management pipeline, preventing silent failures that could be exploited by malicious actors. Regular kernel updates and security auditing of iommu implementations remain essential practices for maintaining system integrity in environments where gpu memory virtualization is utilized.