Linux Kernel ARM SMMU-V3 IOMMU: vDEVICE Stream ID Mis-Map Vulnerability
CVE-2026-74573 Published on August 15, 2026
iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE
In the Linux kernel, the following vulnerability has been resolved:
iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE
arm_vsmmu_vsid_to_sid() maps a guest's vSID to a single physical Stream ID
taken from master->streams[0], assuming a device has exactly one stream. A
device with several streams gets only its first one mapped, so a guest vSID
invalidation cannot reach the others' ATC and IOTLB entries; a device with
none makes master->streams a ZERO_SIZE_PTR, read out of bounds.
Add an arm_vsmmu_vdevice_init() op to reject the vDEVICE with -EOPNOTSUPP
when master->num_streams is not one, rather than mapping it silently.
Products Associated with CVE-2026-74573
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version d68beb276ba26cec47350a6d468e967673ee0c56 and below 3808bab5d95ae79e333e11f6a73d178e084c645d is affected.
- Version d68beb276ba26cec47350a6d468e967673ee0c56 and below 0acbc621341aca4eb94d9c2f43e1ab273ff088f0 is affected.
- Version d68beb276ba26cec47350a6d468e967673ee0c56 and below c3b8ee84a965058b41275069d4696f37a8b14bf6 is affected.
- Version 6.13 is affected.
- Before 6.13 is unaffected.
- Version 6.18.44, <= 6.18.* is unaffected.
- Version 7.1.8, <= 7.1.* is unaffected.
- Version 7.2-rc6, <= * is unaffected.