CVE-2026-74520

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A Use-After-Free (UAF) issue exists in the iommu/iommufd component. The iopf group alloc() function links last-page IOPF groups into a generic pending list. Simultaneously, iommufd fault iopf handler() queues accepted groups into the IOMMUFD deliver list without removing them from the generic pending list. When a device's IOPF reference count reaches zero during detach or HWPT replacement, the iopf queue remove device() function frees groups via the generic pending list but fails to remove them from the IOMMUFD deliver list or response xarray. Consequently, subsequent read, response, or cleanup operations may access the freed memory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.