---
id: CVE-2026-74573
title: 'iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE

  arm_vsmmu_vsid_to_sid() maps a guest's vSID to a single physical Stream ID
  taken from master->st…
severity: critical
cvss: 9.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= d68beb276ba26cec47350a6d468e967673ee0c56 <
    3808bab5d95ae79e333e11f6a73d178e084c645d
  - >-
    Linux >= d68beb276ba26cec47350a6d468e967673ee0c56 <
    0acbc621341aca4eb94d9c2f43e1ab273ff088f0
  - >-
    Linux >= d68beb276ba26cec47350a6d468e967673ee0c56 <
    c3b8ee84a965058b41275069d4696f37a8b14bf6
  - Linux 6.13
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T19:00:36.894843Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T19:05:56.969Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-74573'
references:
  - url: 'https://git.kernel.org/stable/c/3808bab5d95ae79e333e11f6a73d178e084c645d'
  - url: 'https://git.kernel.org/stable/c/0acbc621341aca4eb94d9c2f43e1ab273ff088f0'
  - url: 'https://git.kernel.org/stable/c/c3b8ee84a965058b41275069d4696f37a8b14bf6'
tags:
  - cve.org
epss: 0.00194
epssPercentile: 0.08444
ingestedAt: '2026-10-16T19:46:24.341Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE

arm_vsmmu_vsid_to_sid() maps a guest's vSID to a single physical Stream ID
taken from master->streams[0], assuming a device has exactly one stream. A
device with several streams gets only its first one mapped, so a guest vSID
invalidation cannot reach the others' ATC and IOTLB entries; a device with
none makes master->streams a ZERO_SIZE_PTR, read out of bounds.

Add an arm_vsmmu_vdevice_init() op to reject the vDEVICE with -EOPNOTSUPP
when master->num_streams is not one, rather than mapping it silently.

## Affected

- `Linux >= d68beb276ba26cec47350a6d468e967673ee0c56 < 3808bab5d95ae79e333e11f6a73d178e084c645d`
- `Linux >= d68beb276ba26cec47350a6d468e967673ee0c56 < 0acbc621341aca4eb94d9c2f43e1ab273ff088f0`
- `Linux >= d68beb276ba26cec47350a6d468e967673ee0c56 < c3b8ee84a965058b41275069d4696f37a8b14bf6`
- `Linux 6.13`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.