Executive brief
The VT-d IOMMU driver in the Linux kernel maintains a tree structure to track PCI devices. When a device probe fails under specific conditions (when ATS is not supported), a corrupted cleanup routine can damage this internal tree, potentially causing system instability or denial of service. Systems running affected kernel versions with Intel VT-d IOMMU enabled may experience crashes or data corruption when a device fails to initialize.
Technical details
The vulnerability is a logic error in the VT-d IOMMU probe error path. The device_domain_info structure's RB-tree node (info->node) is zero-initialized via kzalloc, but if a device does not support ATS (Address Translation Services), the device_rbtree_insert() call is skipped. When a subsequent probe step fails, device_rbtree_remove() is called, which misinterprets the zeroed node as a valid tree root and corrupts the device RB-tree via rb_erase(). The fix involves explicitly marking the RB-node as empty using RB_CLEAR_NODE() during initialization and guarding the removal operation with RB_EMPTY_NODE() to prevent erasing nodes that were never inserted. No user interaction or network access is required—the vulnerability triggers automatically during device probe failure in the kernel's IOMMU initialization path.
Affected products
- Linux Linux kernel multiple versions (patch applies across 2.6.11 through 7.2)
Timeline
- 2026-08-15: disclosed: CVE-2026-74355 published
- 2026-06-04: patched: Upstream patch commit 43bd9e6d5513cb1edbafdeef146a1edc3aaced56
- 2026-07-24: patched: Backport to stable kernel (commit d16923a45d4d08367650fdc3451c89299ab6ac5a)