---
id: CVE-2026-74380
title: 'gpu: host1x: Fix iommu_map_sgtable() return value check'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  gpu: host1x: Fix iommu_map_sgtable() return value check

  Commit "iommu: return full error code from iommu_map_sg[_atomic]()"
  changed iommu_map_sgtable() to return an ss…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= ad8f36e4b6b1c826a0daa5fda2c5839205b5aa8b <
    5f3985c2a500df3126cb12a2e0ccf26a40bc495d
  - >-
    Linux >= ad8f36e4b6b1c826a0daa5fda2c5839205b5aa8b <
    3ac173e46ef6fda9c9df8d47cdff4df962df9728
  - >-
    Linux >= ad8f36e4b6b1c826a0daa5fda2c5839205b5aa8b <
    2a68928c445138961e2c451983b473aeb3f5b999
  - >-
    Linux >= ad8f36e4b6b1c826a0daa5fda2c5839205b5aa8b <
    79240eee5a40014d9edfabe19f06b35ffa84e5f8
  - >-
    Linux >= ad8f36e4b6b1c826a0daa5fda2c5839205b5aa8b <
    e024c7993d839503d6c1f0044b8fc537c30300e9
  - >-
    Linux >= ad8f36e4b6b1c826a0daa5fda2c5839205b5aa8b <
    18f74762013a4b6aa6f905c4459e0f506f9c5c7b
  - Linux 5.15
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T18:54:56.549536Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T18:55:36.594Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-74380'
references:
  - url: 'https://git.kernel.org/stable/c/5f3985c2a500df3126cb12a2e0ccf26a40bc495d'
  - url: 'https://git.kernel.org/stable/c/3ac173e46ef6fda9c9df8d47cdff4df962df9728'
  - url: 'https://git.kernel.org/stable/c/2a68928c445138961e2c451983b473aeb3f5b999'
  - url: 'https://git.kernel.org/stable/c/79240eee5a40014d9edfabe19f06b35ffa84e5f8'
  - url: 'https://git.kernel.org/stable/c/e024c7993d839503d6c1f0044b8fc537c30300e9'
  - url: 'https://git.kernel.org/stable/c/18f74762013a4b6aa6f905c4459e0f506f9c5c7b'
tags:
  - cve.org
epss: 0.00176
epssPercentile: 0.06634
ingestedAt: '2026-10-16T19:46:24.371Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

gpu: host1x: Fix iommu_map_sgtable() return value check

Commit "iommu: return full error code from iommu_map_sg[_atomic]()"
changed iommu_map_sgtable() to return an ssize_t and negative values
in error cases, rather than a size_t and a zero.

pin_job() also was incorrectly assigning to 'int', which could cause
overflows into negative values.

Update pin_job() to correctly check for errors from iommu_map_sgtable.

## Affected

- `Linux >= ad8f36e4b6b1c826a0daa5fda2c5839205b5aa8b < 5f3985c2a500df3126cb12a2e0ccf26a40bc495d`
- `Linux >= ad8f36e4b6b1c826a0daa5fda2c5839205b5aa8b < 3ac173e46ef6fda9c9df8d47cdff4df962df9728`
- `Linux >= ad8f36e4b6b1c826a0daa5fda2c5839205b5aa8b < 2a68928c445138961e2c451983b473aeb3f5b999`
- `Linux >= ad8f36e4b6b1c826a0daa5fda2c5839205b5aa8b < 79240eee5a40014d9edfabe19f06b35ffa84e5f8`
- `Linux >= ad8f36e4b6b1c826a0daa5fda2c5839205b5aa8b < e024c7993d839503d6c1f0044b8fc537c30300e9`
- `Linux >= ad8f36e4b6b1c826a0daa5fda2c5839205b5aa8b < 18f74762013a4b6aa6f905c4459e0f506f9c5c7b`
- `Linux 5.15`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.