CVE-2026-74573

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the iommu/arm-smmu-v3-iommufd component where the arm vsmmu vsid to sid() function incorrectly assumes a device has exactly one stream. When a device has multiple streams, only the first one is mapped, preventing guest vSID invalidation from reaching the Address Translation Cache (ATC) and Input-Output Translation Lookaside Buffer (IOTLB) entries of the other streams. Additionally, if a device has no streams, master->streams becomes a ZERO SIZE PTR, leading to an out-of-bounds read. The arm vsmmu vdevice init() function was updated to reject vDEVICEs where master->num streams is not equal to one.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.