CVE-2026-74328

In the Linux kernel, the following vulnerability has been resolved: iommufd: Destroy the pages content after detaching from dmabuf Sashiko points out this has gotten out of order, the mutex could still be in use through the dmabuf invalidation callbacks. Don't destroy any of the pages content until the dmabuf is fully detached.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.0 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://git.kernel.org/stable/c/0507fcedbdcc87281ef8639c045fc9980363bbb6
https://git.kernel.org/stable/c/f2d70dbd3dcefa8e3c380beff9c31f5f033a4221

Configurations

No configuration.

History

No history.

Information

Published : 2026-08-15 06:22

Updated : 2026-08-17 06:19

NVD link : CVE-2026-74328

Mitre link : CVE-2026-74328

CVE.ORG link : CVE-2026-74328

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2026-74328", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.0}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "71db84a092c399f434976d0522e848e9803cd51a", "lessThan": "0507fcedbdcc87281ef8639c045fc9980363bbb6", "versionType": "git"}, {"status": "affected", "version": "71db84a092c399f434976d0522e848e9803cd51a", "lessThan": "f2d70dbd3dcefa8e3c380beff9c31f5f033a4221", "versionType": "git"}], "programFiles": ["drivers/iommu/iommufd/pages.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.19"}, {"status": "unaffected", "version": "0", "lessThan": "6.19", "versionType": "semver"}, {"status": "unaffected", "version": "7.1.5", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/iommu/iommufd/pages.c"], "defaultStatus": "affected"}]}], "published": "2026-08-15T06:22:33.520", "references": [{"url": "https://git.kernel.org/stable/c/0507fcedbdcc87281ef8639c045fc9980363bbb6", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/f2d70dbd3dcefa8e3c380beff9c31f5f033a4221", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Received", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommufd: Destroy the pages content after detaching from dmabuf\n\nSashiko points out this has gotten out of order, the mutex could still be\nin use through the dmabuf invalidation callbacks. Don't destroy any of the\npages content until the dmabuf is fully detached."}], "lastModified": "2026-08-17T06:19:27.213", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}