---
id: CVE-2026-74277
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path

  In iommu_dma_map_sg(), when handling PCI P2PDMA cases, the DMA length
  of the current scatterlis…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path

  In iommu_dma_map_sg(), when handling PCI P2PDMA cases, the DMA length
  of the current scatterlis…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= a25e7962db0d79882c9d32fd2a67a02e79129c0e <
    6166cb1344f16dd403f2192f4bea6f6654f1ae1e
  - >-
    Linux >= a25e7962db0d79882c9d32fd2a67a02e79129c0e <
    8646f00ce021e49f4f05bc1d4060a0c27b25d0e1
  - >-
    Linux >= a25e7962db0d79882c9d32fd2a67a02e79129c0e <
    db50fb87015b955a5a0c155293b2dd40d63a3b9e
  - Linux 6.16
published: '2026-08-15'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T11:17:44.813'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-74277'
references:
  - url: 'https://git.kernel.org/stable/c/6166cb1344f16dd403f2192f4bea6f6654f1ae1e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/8646f00ce021e49f4f05bc1d4060a0c27b25d0e1'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/db50fb87015b955a5a0c155293b2dd40d63a3b9e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00165
epssPercentile: 0.0532
ingestedAt: '2026-10-15T11:00:41.678Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path

In iommu_dma_map_sg(), when handling PCI P2PDMA cases, the DMA length
of the current scatterlist segment `s` is incorrectly assigned from the
head entry `sg->length` instead of the current entry `s->length`.

This typo causes all P2PDMA segments in the scatterlist to inherit the
length of the first segment, leading to corrupted DMA lengths for multi-
segment scatterlists.

Fix this by using `s->length` instead of `sg->length`.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.