---
id: CVE-2026-74520
title: 'iommu/iommufd: Fix IOPF group ownership UAF'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  iommu/iommufd: Fix IOPF group ownership UAF

  iopf_group_alloc() links each last-page IOPF group into the generic IOPF
  pending list before invoking the domain fault hand…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 34765cbc679c59ea5d952d738d2d16bf4aadc497 <
    6da8f37419dd4c456f26fc203f04e000186f4b3d
  - >-
    Linux >= 34765cbc679c59ea5d952d738d2d16bf4aadc497 <
    4e74a369236424114b94cf6a9f5ff9e848b430b4
  - >-
    Linux >= 34765cbc679c59ea5d952d738d2d16bf4aadc497 <
    738e6f32e61d80b554e37015ecb7bc620b88001c
  - Linux 6.11
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T18:59:01.666687Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T19:05:52.700Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-74520'
references:
  - url: 'https://git.kernel.org/stable/c/6da8f37419dd4c456f26fc203f04e000186f4b3d'
  - url: 'https://git.kernel.org/stable/c/4e74a369236424114b94cf6a9f5ff9e848b430b4'
  - url: 'https://git.kernel.org/stable/c/738e6f32e61d80b554e37015ecb7bc620b88001c'
tags:
  - cve.org
epss: 0.00173
epssPercentile: 0.06332
ingestedAt: '2026-10-16T19:46:24.351Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

iommu/iommufd: Fix IOPF group ownership UAF

iopf_group_alloc() links each last-page IOPF group into the generic IOPF
pending list before invoking the domain fault handler.
iommufd_fault_iopf_handler() also queued an accepted group in the
IOMMUFD deliver list without removing it from the generic pending list.

When detach or HWPT replacement drops the device's IOPF reference count
to zero, an IOMMU driver may call iopf_queue_remove_device(). That
function responds to and frees groups through the generic pending list
without removing the same groups from IOMMUFD's deliver list or response
xarray. A later read, response, or cleanup can then access the freed
group and cause a UAF.

Fix this by dequeuing an accepted group from the generic pending list
before IOMMUFD queues it for userspace response.
Make iopf_group_response() send a response regardless of pending-list
membership, so the dequeued group can still be completed by IOMMUFD.

## Affected

- `Linux >= 34765cbc679c59ea5d952d738d2d16bf4aadc497 < 6da8f37419dd4c456f26fc203f04e000186f4b3d`
- `Linux >= 34765cbc679c59ea5d952d738d2d16bf4aadc497 < 4e74a369236424114b94cf6a9f5ff9e848b430b4`
- `Linux >= 34765cbc679c59ea5d952d738d2d16bf4aadc497 < 738e6f32e61d80b554e37015ecb7bc620b88001c`
- `Linux 6.11`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.