CVE-2026-74573 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE
arm_vsmmu_vsid_to_sid() maps a guest's vSID to a single physical Stream ID taken from master->streams[0], assuming a device has exactly one stream. A
device with several streams gets only its first one mapped, so a guest vSID invalidation cannot reach the others' ATC and IOTLB entries; a device with none makes master->streams a ZERO_SIZE_PTR, read out of bounds.
Add an arm_vsmmu_vdevice_init() op to reject the vDEVICE with -EOPNOTSUPP when master->num_streams is not one, rather than mapping it silently.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/15/2026
This vulnerability exists in the linux kernel's arm-smmu-v3-iommufd implementation where a critical flaw in stream id handling creates potential security and stability risks. The issue specifically affects the arm_vsmmu_vsid_to_sid() function which assumes that each device possesses exactly one stream identifier, mapping guest virtual stream ids to physical stream ids using master->streams[0]. This assumption fails when devices have multiple streams or no streams at all, creating a fundamental mismatch between virtual and physical memory management. When a device contains multiple streams, only the first stream is mapped through the master->streams[0] index, leaving other streams unmapped and vulnerable to inconsistent state management. Conversely, devices with zero streams result in master->streams becoming a ZERO_SIZE_PTR which leads to out-of-bounds memory access patterns that can compromise system stability.
The operational impact of this vulnerability extends beyond simple memory corruption to encompass potential privilege escalation and denial of service conditions within virtualized environments. The silent failure mode means that device configurations with multiple or zero streams are not properly rejected during initialization, allowing malformed device states to persist in the system. This creates a scenario where guest operating systems can manipulate stream id invalidation operations that fail to reach all relevant translation table entries, potentially leaving stale cache entries accessible to unauthorized processes or creating inconsistent memory mappings. The vulnerability directly violates security principles by allowing improper device state management and could enable attackers to exploit inconsistent memory access patterns to gain elevated privileges within virtualized environments.
The fix implemented addresses this issue by introducing a new arm_vsmmu_vdevice_init() operational function that explicitly validates the number of streams associated with each device during initialization. This validation ensures that devices with exactly one stream are permitted while rejecting configurations with multiple or zero streams with an -EOPNOTSUPP error code, preventing the silent acceptance of malformed device states. This approach aligns with the principle of least privilege and proper input validation as recommended by various security frameworks including those addressing common weaknesses such as CWE-129, which covers improper validation of array indices, and CWE-707, which addresses improper neutralization of special elements used in information access. The solution follows ATT&CK framework concepts related to privilege escalation through memory corruption and system modification techniques, ensuring that virtual device initialization fails fast rather than allowing potentially exploitable states to persist.
The mitigation strategy ensures that only properly configured devices with single stream identifiers are accepted into the virtualized IOMMU management system, preventing both denial of service conditions from out-of-bounds memory access and potential privilege escalation vectors. This fix specifically addresses a class of vulnerabilities related to improper handling of IOMMU device configurations in virtualized environments where the assumption of single-stream devices breaks down under complex hardware configurations. The implementation aligns with industry best practices for virtualization security by enforcing strict device validation during initialization phases rather than allowing malformed states to propagate through the system, thereby maintaining the integrity of memory management operations and preventing potential exploitation through memory corruption attacks targeting IOMMU subsystem components.