Executive brief
The ARM SMMU-v3 IOMMU controller driver in the Linux kernel contains a logic error in its virtualization support that fails to validate device stream configurations. This allows improperly configured virtual devices to be created, potentially exposing physical memory pages and causing IOTLB invalidation failures that could lead to data corruption or privilege escalation.
Technical details
The vulnerability exists in the arm-smmu-v3-iommufd driver, which maps guest virtual Stream IDs (vSID) to physical Stream IDs using only master->streams[0]. The arm_vsmmu_vsid_to_sid() function assumes every device has exactly one stream but lacks validation. A device with multiple streams silently maps only the first one, leaving other ATC and IOTLB entries unreachable during guest invalidation operations. A device with zero streams causes an out-of-bounds read of a ZERO_SIZE_PTR. The fix adds an arm_vsmmu_vdevice_init() callback that rejects virtual device creation with -EOPNOTSUPP when master->num_streams != 1. This is a local privilege escalation requiring userspace ability to create IOMMU virtual devices. The patch has been applied to stable kernel series.
Affected products
- Linux Linux kernel 5.10 through 6.x before fix
Timeline
- 2026-08-15: disclosed: CVE-2026-74573 published on NVD
- 2026-08-09: patched: Patch merged into stable kernel branches