{"apiVersion":"1.0","identifier":"CVE-2026-74520","description":"In the Linux kernel, the following vulnerability has been resolved: iommu/iommufd: Fix IOPF group ownership UAF iopf_group_alloc() links each last-page IOPF group into the generic IOPF pending list before invoking the domain fault handler. iommufd_fault_iopf_handler() also queued an accepted group in the IOMMUFD deliver list without removing it from the generic pending list. When detach or HWPT replacement drops the device-s IOPF reference count to zero, an IOMMU driver may call iopf_queue_remove_device(). That function responds to and frees groups through the generic pending list without removing the same groups from IOMMUFD-s deliver list or response xarray. A later read, response, or cleanup can then access the freed group and cause a UAF. Fix this by dequeuing an accepted group from the generic pending list before IOMMUFD queues it for userspace response. Make iopf_group_response() send a response regardless of pending-list membership, so the dequeued group can still be completed by IOMMUFD.","publishedAt":"2026-08-15T13:17:57","lastModifiedAt":"2026-08-17T06:19:48","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74520","cvssScore":8.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","epssProbability":0.00127,"riskScore":0.89,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-74520","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-74520","en":"https://www.redsauce.net/en/cves/CVE-2026-74520","fr":"https://www.redsauce.net/fr/cves/CVE-2026-74520","pt":"https://www.redsauce.net/pt/cves/CVE-2026-74520","de":"https://www.redsauce.net/de/cves/CVE-2026-74520","sk":"https://www.redsauce.net/sk/cves/CVE-2026-74520","el":"https://www.redsauce.net/el/cves/CVE-2026-74520"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-74520"}}