{"id":"CVE-2026-74380","title":"gpu: host1x: Fix iommu_map_sgtable() return value check","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ngpu: host1x: Fix iommu_map_sgtable() return value check\n\nCommit \"iommu: return full error code from iommu_map_sg[_atomic]()\"\nchanged iommu_map_sgtable() to return an ss…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= ad8f36e4b6b1c826a0daa5fda2c5839205b5aa8b < 5f3985c2a500df3126cb12a2e0ccf26a40bc495d","Linux >= ad8f36e4b6b1c826a0daa5fda2c5839205b5aa8b < 3ac173e46ef6fda9c9df8d47cdff4df962df9728","Linux >= ad8f36e4b6b1c826a0daa5fda2c5839205b5aa8b < 2a68928c445138961e2c451983b473aeb3f5b999","Linux >= ad8f36e4b6b1c826a0daa5fda2c5839205b5aa8b < 79240eee5a40014d9edfabe19f06b35ffa84e5f8","Linux >= ad8f36e4b6b1c826a0daa5fda2c5839205b5aa8b < e024c7993d839503d6c1f0044b8fc537c30300e9","Linux >= ad8f36e4b6b1c826a0daa5fda2c5839205b5aa8b < 18f74762013a4b6aa6f905c4459e0f506f9c5c7b","Linux 5.15"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T18:54:56.549536Z"},"published":"2026-08-15","updated":"2026-10-16","sourceUpdated":"2026-10-16T18:55:36.594Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-74380","references":[{"url":"https://git.kernel.org/stable/c/5f3985c2a500df3126cb12a2e0ccf26a40bc495d"},{"url":"https://git.kernel.org/stable/c/3ac173e46ef6fda9c9df8d47cdff4df962df9728"},{"url":"https://git.kernel.org/stable/c/2a68928c445138961e2c451983b473aeb3f5b999"},{"url":"https://git.kernel.org/stable/c/79240eee5a40014d9edfabe19f06b35ffa84e5f8"},{"url":"https://git.kernel.org/stable/c/e024c7993d839503d6c1f0044b8fc537c30300e9"},{"url":"https://git.kernel.org/stable/c/18f74762013a4b6aa6f905c4459e0f506f9c5c7b"}],"tags":["cve.org"],"epss":0.00176,"epssPercentile":0.06634,"ingestedAt":"2026-10-16T19:46:24.371Z","slug":"CVE-2026-74380","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ngpu: host1x: Fix iommu_map_sgtable() return value check\n\nCommit \"iommu: return full error code from iommu_map_sg[_atomic]()\"\nchanged iommu_map_sgtable() to return an ssize_t and negative values\nin error cases, rather than a size_t and a zero.\n\npin_job() also was incorrectly assigning to 'int', which could cause\noverflows into negative values.\n\nUpdate pin_job() to correctly check for errors from iommu_map_sgtable.\n\n## Affected\n\n- `Linux >= ad8f36e4b6b1c826a0daa5fda2c5839205b5aa8b < 5f3985c2a500df3126cb12a2e0ccf26a40bc495d`\n- `Linux >= ad8f36e4b6b1c826a0daa5fda2c5839205b5aa8b < 3ac173e46ef6fda9c9df8d47cdff4df962df9728`\n- `Linux >= ad8f36e4b6b1c826a0daa5fda2c5839205b5aa8b < 2a68928c445138961e2c451983b473aeb3f5b999`\n- `Linux >= ad8f36e4b6b1c826a0daa5fda2c5839205b5aa8b < 79240eee5a40014d9edfabe19f06b35ffa84e5f8`\n- `Linux >= ad8f36e4b6b1c826a0daa5fda2c5839205b5aa8b < e024c7993d839503d6c1f0044b8fc537c30300e9`\n- `Linux >= ad8f36e4b6b1c826a0daa5fda2c5839205b5aa8b < 18f74762013a4b6aa6f905c4459e0f506f9c5c7b`\n- `Linux 5.15`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}