CVE-2026-74573: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-74573 is a memory disclosure vulnerability in the Linux kernel's ARM SMMUv3 IOMMUFD driver (drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-iommufd.c) caused by incorrect Stream ID handling during virtual device (vDEVICE) initialization. The arm_vsmmu_vsid_to_sid() function incorrectly assumes every device has exactly one Stream ID, leading to out-of-bounds reads on devices with zero streams and incomplete IOMMU translation cache invalidation on devices with multiple streams. It was published on August 15, 2026, and affects Linux kernel versions starting from 6.13 up to (but not including) 6.18.44 and 7.1.8 (Github Advisory, Feedly). No CVSS score has been formally assigned by NVD at this time; Feedly estimates the severity as Medium (Feedly).

The root cause is a missing input validation check (related to improper bounds checking / CWE class) in arm_vsmmu_vsid_to_sid(), which unconditionally dereferences master->streams[0] without verifying that master->num_streams equals exactly one. When a device has zero streams, master->streams becomes a ZERO_SIZE_PTR, and reading from it constitutes an out-of-bounds memory read. When a device has multiple streams, only the first stream is mapped, so guest vSID invalidation commands cannot reach the Address Translation Cache (ATC) and I/O TLB (IOTLB) entries of the remaining streams, potentially leaving stale translation entries. The fix introduces an arm_vsmmu_vdevice_init() operation that rejects vDEVICE configurations where num_streams != 1 with -EOPNOTSUPP, preventing silent misconfiguration (Github Advisory, Feedly).

A privileged user with access to configure ARM SMMUv3 IOMMUFD virtual devices can trigger out-of-bounds kernel memory reads on systems with zero-stream devices, potentially leaking sensitive kernel memory contents. On devices with multiple Stream IDs, the incomplete IOMMU translation cache invalidation could allow stale or incorrect address translations to persist, potentially enabling address translation attacks or bypassing IOMMU isolation protections in virtualized environments. The affected component is central to device passthrough security in ARM-based virtualization scenarios, meaning exploitation could undermine the isolation guarantees between guest VMs and the host (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is 0.0, indicating a very low probability of exploitation in the near term (Feedly). Exploitation requires privileged access to configure IOMMUFD virtual devices, significantly limiting the attack surface. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Update the Linux kernel to a patched version: 6.18.44 or later in the 6.18.x series, or 7.1.8 or later in the 7.1.x series; the fix is also included in 7.2-rc6 and later (Github Advisory). The specific fix commits are 3808bab5d95ae79e333e11f6a73d178e084c645d, 0acbc621341aca4eb94d9c2f43e1ab273ff088f0, and c3b8ee84a965058b41275069d4696f37a8b14bf6 on the stable kernel tree. As a configuration-based mitigation, restrict access to ARM SMMUv3 IOMMUFD device configuration to trusted administrators only, and monitor for IOMMUFD device creation attempts returning -EOPNOTSUPP errors, which may indicate misconfigured or potentially malicious device setups (Feedly).