{"id":"CVE-2026-74573","title":"iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\niommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE\n\narm_vsmmu_vsid_to_sid() maps a guest's vSID to a single physical Stream ID\ntaken from master->st…","severity":"critical","cvss":9.3,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= d68beb276ba26cec47350a6d468e967673ee0c56 < 3808bab5d95ae79e333e11f6a73d178e084c645d","Linux >= d68beb276ba26cec47350a6d468e967673ee0c56 < 0acbc621341aca4eb94d9c2f43e1ab273ff088f0","Linux >= d68beb276ba26cec47350a6d468e967673ee0c56 < c3b8ee84a965058b41275069d4696f37a8b14bf6","Linux 6.13"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T19:00:36.894843Z"},"published":"2026-08-15","updated":"2026-10-16","sourceUpdated":"2026-10-16T19:05:56.969Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-74573","references":[{"url":"https://git.kernel.org/stable/c/3808bab5d95ae79e333e11f6a73d178e084c645d"},{"url":"https://git.kernel.org/stable/c/0acbc621341aca4eb94d9c2f43e1ab273ff088f0"},{"url":"https://git.kernel.org/stable/c/c3b8ee84a965058b41275069d4696f37a8b14bf6"}],"tags":["cve.org"],"epss":0.00194,"epssPercentile":0.08444,"ingestedAt":"2026-10-16T19:46:24.341Z","slug":"CVE-2026-74573","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE\n\narm_vsmmu_vsid_to_sid() maps a guest's vSID to a single physical Stream ID\ntaken from master->streams[0], assuming a device has exactly one stream. A\ndevice with several streams gets only its first one mapped, so a guest vSID\ninvalidation cannot reach the others' ATC and IOTLB entries; a device with\nnone makes master->streams a ZERO_SIZE_PTR, read out of bounds.\n\nAdd an arm_vsmmu_vdevice_init() op to reject the vDEVICE with -EOPNOTSUPP\nwhen master->num_streams is not one, rather than mapping it silently.\n\n## Affected\n\n- `Linux >= d68beb276ba26cec47350a6d468e967673ee0c56 < 3808bab5d95ae79e333e11f6a73d178e084c645d`\n- `Linux >= d68beb276ba26cec47350a6d468e967673ee0c56 < 0acbc621341aca4eb94d9c2f43e1ab273ff088f0`\n- `Linux >= d68beb276ba26cec47350a6d468e967673ee0c56 < c3b8ee84a965058b41275069d4696f37a8b14bf6`\n- `Linux 6.13`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":51,"depthScoreParts":{"impact":51.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}