CVE-2026-74380 (GCVE-0-2026-74380)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:58 – Updated: 2026-08-17 05:46
VLAI
Title
gpu: host1x: Fix iommu_map_sgtable() return value check
Summary
In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix iommu_map_sgtable() return value check Commit "iommu: return full error code from iommu_map_sg[_atomic]()" changed iommu_map_sgtable() to return an ssize_t and negative values in error cases, rather than a size_t and a zero. pin_job() also was incorrectly assigning to 'int', which could cause overflows into negative values. Update pin_job() to correctly check for errors from iommu_map_sgtable.
Severity
8.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: ad8f36e4b6b1c826a0daa5fda2c5839205b5aa8b , < 5f3985c2a500df3126cb12a2e0ccf26a40bc495d (git)
Affected: ad8f36e4b6b1c826a0daa5fda2c5839205b5aa8b , < 3ac173e46ef6fda9c9df8d47cdff4df962df9728 (git)
Affected: ad8f36e4b6b1c826a0daa5fda2c5839205b5aa8b , < 2a68928c445138961e2c451983b473aeb3f5b999 (git)
Affected: ad8f36e4b6b1c826a0daa5fda2c5839205b5aa8b , < 79240eee5a40014d9edfabe19f06b35ffa84e5f8 (git)
Affected: ad8f36e4b6b1c826a0daa5fda2c5839205b5aa8b , < e024c7993d839503d6c1f0044b8fc537c30300e9 (git)
Affected: ad8f36e4b6b1c826a0daa5fda2c5839205b5aa8b , < 18f74762013a4b6aa6f905c4459e0f506f9c5c7b (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/host1x/job.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5f3985c2a500df3126cb12a2e0ccf26a40bc495d",
              "status": "affected",
              "version": "ad8f36e4b6b1c826a0daa5fda2c5839205b5aa8b",
              "versionType": "git"
            },
            {
              "lessThan": "3ac173e46ef6fda9c9df8d47cdff4df962df9728",
              "status": "affected",
              "version": "ad8f36e4b6b1c826a0daa5fda2c5839205b5aa8b",
              "versionType": "git"
            },
            {
              "lessThan": "2a68928c445138961e2c451983b473aeb3f5b999",
              "status": "affected",
              "version": "ad8f36e4b6b1c826a0daa5fda2c5839205b5aa8b",
              "versionType": "git"
            },
            {
              "lessThan": "79240eee5a40014d9edfabe19f06b35ffa84e5f8",
              "status": "affected",
              "version": "ad8f36e4b6b1c826a0daa5fda2c5839205b5aa8b",
              "versionType": "git"
            },
            {
              "lessThan": "e024c7993d839503d6c1f0044b8fc537c30300e9",
              "status": "affected",
              "version": "ad8f36e4b6b1c826a0daa5fda2c5839205b5aa8b",
              "versionType": "git"
            },
            {
              "lessThan": "18f74762013a4b6aa6f905c4459e0f506f9c5c7b",
              "status": "affected",
              "version": "ad8f36e4b6b1c826a0daa5fda2c5839205b5aa8b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/host1x/job.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpu: host1x: Fix iommu_map_sgtable() return value check\n\nCommit \"iommu: return full error code from iommu_map_sg[_atomic]()\"\nchanged iommu_map_sgtable() to return an ssize_t and negative values\nin error cases, rather than a size_t and a zero.\n\npin_job() also was incorrectly assigning to \u0027int\u0027, which could cause\noverflows into negative values.\n\nUpdate pin_job() to correctly check for errors from iommu_map_sgtable."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is in host1x pin_job() reached from tegra DRM TEGRA_CHANNEL_SUBMIT ioctls on /dev/dri/renderD*, requiring local access to the GPU render node on Tegra/Jetson, automotive, and embedded platforms.\nAC:L - An attacker with render-node access can reliably submit host1x jobs and force iommu_map_sgtable() failures (e.g., via memory/IOVA pressure or alignment edge cases); no victim-controlled race or rare configuration is required.\nPR:L - Exploitation needs only unprivileged access to the DRM render node, which is commonly granted to local users and containerized GPU workloads on Tegra124+ systems with host1x IOMMU enabled; no real-root capability is required.\nUI:N - Triggering the flaw is fully programmatic through DRM ioctls and host1x job submission; no additional victim interaction such as plugging devices or mounting filesystems is needed.\nS:C - When iommu_map_sgtable() fails, the driver still programs host1x/GPU gather DMA with an IOVA lacking a valid IOMMU mapping, breaking the IOMMU/DMA isolation boundary between device DMA and system physical memory.\nC:H - Proceeding without a valid IOMMU translation lets host1x fetch gather/command streams via an unmapped IOVA, enabling GPU DMA reads outside the intended buffer and potential disclosure of unintended physical memory depending on SMMU fault behavior.\nI:H - Corrupted or attacker-influenced gather fetches can drive subsequent host1x client engines to perform unintended DMA writes; failed IOMMU setup removes the mapping that was meant to confine GPU memory access.\nA:H - Submitting jobs with unmapped IOVAs causes IOMMU faults, GPU/host1x hangs or timeouts, and potential kernel oops/panic on affected Tegra systems, yielding a repeatable local denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:46:31.945Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5f3985c2a500df3126cb12a2e0ccf26a40bc495d"
        },
        {
          "url": "https://git.kernel.org/stable/c/3ac173e46ef6fda9c9df8d47cdff4df962df9728"
        },
        {
          "url": "https://git.kernel.org/stable/c/2a68928c445138961e2c451983b473aeb3f5b999"
        },
        {
          "url": "https://git.kernel.org/stable/c/79240eee5a40014d9edfabe19f06b35ffa84e5f8"
        },
        {
          "url": "https://git.kernel.org/stable/c/e024c7993d839503d6c1f0044b8fc537c30300e9"
        },
        {
          "url": "https://git.kernel.org/stable/c/18f74762013a4b6aa6f905c4459e0f506f9c5c7b"
        }
      ],
      "title": "gpu: host1x: Fix iommu_map_sgtable() return value check",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74380",
    "datePublished": "2026-08-15T05:58:57.706Z",
    "dateReserved": "2026-08-15T05:44:03.890Z",
    "dateUpdated": "2026-08-17T05:46:31.945Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74380",
      "date": "2026-09-21",
      "epss": "0.00129",
      "percentile": "0.0295"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/host1x/job.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "5f3985c2a500df3126cb12a2e0ccf26a40bc495d",
                    "status": "affected",
                    "version": "ad8f36e4b6b1c826a0daa5fda2c5839205b5aa8b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3ac173e46ef6fda9c9df8d47cdff4df962df9728",
                    "status": "affected",
                    "version": "ad8f36e4b6b1c826a0daa5fda2c5839205b5aa8b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2a68928c445138961e2c451983b473aeb3f5b999",
                    "status": "affected",
                    "version": "ad8f36e4b6b1c826a0daa5fda2c5839205b5aa8b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "79240eee5a40014d9edfabe19f06b35ffa84e5f8",
                    "status": "affected",
                    "version": "ad8f36e4b6b1c826a0daa5fda2c5839205b5aa8b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e024c7993d839503d6c1f0044b8fc537c30300e9",
                    "status": "affected",
                    "version": "ad8f36e4b6b1c826a0daa5fda2c5839205b5aa8b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "18f74762013a4b6aa6f905c4459e0f506f9c5c7b",
                    "status": "affected",
                    "version": "ad8f36e4b6b1c826a0daa5fda2c5839205b5aa8b",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/host1x/job.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.15"
                  },
                  {
                    "lessThan": "5.15",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpu: host1x: Fix iommu_map_sgtable() return value check\n\nCommit \"iommu: return full error code from iommu_map_sg[_atomic]()\"\nchanged iommu_map_sgtable() to return an ssize_t and negative values\nin error cases, rather than a size_t and a zero.\n\npin_job() also was incorrectly assigning to \u0027int\u0027, which could cause\noverflows into negative values.\n\nUpdate pin_job() to correctly check for errors from iommu_map_sgtable."
          }
        ],
        "id": "CVE-2026-74380",
        "lastModified": "2026-08-17T06:19:32.857",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.0,
              "impactScore": 6.0,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:22:39.820",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/18f74762013a4b6aa6f905c4459e0f506f9c5c7b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2a68928c445138961e2c451983b473aeb3f5b999"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3ac173e46ef6fda9c9df8d47cdff4df962df9728"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5f3985c2a500df3126cb12a2e0ccf26a40bc495d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/79240eee5a40014d9edfabe19f06b35ffa84e5f8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e024c7993d839503d6c1f0044b8fc537c30300e9"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-19T10:02:50+00:00",
      "cve": "CVE-2026-74380",
      "id": "CVE-2026-74380",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: gpu: host1x: Fix iommu_map_sgtable() return value check",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74380.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-03T00:06:37Z",
      "cve": "CVE-2026-74380",
      "id": "CVE-2026-74380",
      "initial_release_date": "2026-09-03T00:06:37Z",
      "product_status:known_affected": "84",
      "product_status:known_not_affected": "278",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74380",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74380.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.