{"id":"CVE-2026-74277","title":"In the Linux kernel, the following vulnerability has been resolved:\n\niommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path\n\nIn iommu_dma_map_sg(), when handling PCI P2PDMA cases, the DMA length\nof the current scatterlis…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\niommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path\n\nIn iommu_dma_map_sg(), when handling PCI P2PDMA cases, the DMA length\nof the current scatterlis…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","vendor":"Linux","product":"Linux","affected":["Linux >= a25e7962db0d79882c9d32fd2a67a02e79129c0e < 6166cb1344f16dd403f2192f4bea6f6654f1ae1e","Linux >= a25e7962db0d79882c9d32fd2a67a02e79129c0e < 8646f00ce021e49f4f05bc1d4060a0c27b25d0e1","Linux >= a25e7962db0d79882c9d32fd2a67a02e79129c0e < db50fb87015b955a5a0c155293b2dd40d63a3b9e","Linux 6.16"],"published":"2026-08-15","updated":"2026-10-15","sourceUpdated":"2026-10-15T11:17:44.813","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74277","references":[{"url":"https://git.kernel.org/stable/c/6166cb1344f16dd403f2192f4bea6f6654f1ae1e","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8646f00ce021e49f4f05bc1d4060a0c27b25d0e1","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/db50fb87015b955a5a0c155293b2dd40d63a3b9e","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"epss":0.00165,"epssPercentile":0.0532,"ingestedAt":"2026-10-15T11:00:41.678Z","slug":"CVE-2026-74277","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path\n\nIn iommu_dma_map_sg(), when handling PCI P2PDMA cases, the DMA length\nof the current scatterlist segment `s` is incorrectly assigned from the\nhead entry `sg->length` instead of the current entry `s->length`.\n\nThis typo causes all P2PDMA segments in the scatterlist to inherit the\nlength of the first segment, leading to corrupted DMA lengths for multi-\nsegment scatterlists.\n\nFix this by using `s->length` instead of `sg->length`.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}