CVE-2026-74573
CRITICAL 9.3 ALL-YEARSIn the Linux kernel, the following vulnerability has been resolved: iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE arm_vsmmu_vsid_to_sid() maps a guest's vSID to a single physical Stream ID taken from master->streams[0], assuming a device has exactly one stream. A device with several streams gets only its first one mapped, so a guest vSID invalidation cannot reach the others' ATC and IOTLB entries; a device with none makes master->streams a ZERO_SIZE_PTR, read out of bounds. Add an arm_vsmmu_vdevice_init() op to reject the vDEVICE with -EOPNOTSUPP when master->num_streams is not one, rather than mapping it silently.
Severe if exploited (CVSS 9.3), but no confirmed exploitation. Patch on a normal cadence.
Exploitation likelihood
0.2%chance of exploitation in 30 days · 9th percentile
Impact if exploited
9.3CVSS 3.1 · CRITICAL · CNA
- ConfidentialityHigh
- IntegrityHigh
- AvailabilityHigh
What an attacker needs
- ⚠Access: Requires local access to the host
- ✓Privileges: No account or privileges required
- ✓User interaction: No user interaction needed
- ✓Complexity: No special conditions — reliably repeatable
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Weakness (CWE)
Not classified.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References and research data (JSON)
Vendor product assessments
Showing 32 of 275 vendor product statements; 243 omitted. Read the full vendor advisory.
kernel as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Affected
kernel-64k-modules as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-64k-modules
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Affected
kernel-devel as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-devel
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Affected
kernel-rt-64k-debug-core as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-64k-debug-core
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Affected
kernel-rt-debug-devel as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-debug-devel
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Affected
kernel-tools-libs-devel as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-tools-libs-devel
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Affected
python3-perf as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/python3-perf
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Affected
kernel-64k-debug-modules-core as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-64k-debug-modules-core
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Affected
kernel-core as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-core
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Affected
kernel-debug-uki-virt-addons as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-debug-uki-virt-addons
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Affected
kernel-rt-64k-core as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-64k-core
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Affected
kernel-rt-64k-devel-matched as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-64k-devel-matched
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Affected
kernel-rt-debug-kvm as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-debug-kvm
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Affected
kernel-rt-modules-internal as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-modules-internal
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Affected
kernel-zfcpdump-devel-matched as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-zfcpdump-devel-matched
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Affected
rv as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/rv
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Affected
kernel as a component of Red Hat Enterprise Linux 6 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel
Red Hat · CVE-2026-74573 · Updated 2026-10-14T18:49:02+00:00kernel-doc as a component of Red Hat Enterprise Linux 6 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-doc
Red Hat · CVE-2026-74573 · Updated 2026-10-14T18:49:02+00:00perf as a component of Red Hat Enterprise Linux 6 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/perf
Red Hat · CVE-2026-74573 · Updated 2026-10-14T18:49:02+00:00kernel-debug as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-debug
Red Hat · CVE-2026-74573 · Updated 2026-10-14T18:49:02+00:00kernel-kdump-devel as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-kdump-devel
Red Hat · CVE-2026-74573 · Updated 2026-10-14T18:49:02+00:00kernel-rt-doc as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt-doc
Red Hat · CVE-2026-74573 · Updated 2026-10-14T18:49:02+00:00kernel-tools as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-tools
Red Hat · CVE-2026-74573 · Updated 2026-10-14T18:49:02+00:00bpftool as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/bpftool
Red Hat · CVE-2026-74573 · Updated 2026-10-14T18:49:02+00:00kernel-cross-headers as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-cross-headers
Red Hat · CVE-2026-74573 · Updated 2026-10-14T18:49:02+00:00kernel-debug-modules-internal as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-debug-modules-internal
Red Hat · CVE-2026-74573 · Updated 2026-10-14T18:49:02+00:00kernel-modules-extra as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-modules-extra
Red Hat · CVE-2026-74573 · Updated 2026-10-14T18:49:02+00:00kernel-rt-debug-devel as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt-debug-devel
Red Hat · CVE-2026-74573 · Updated 2026-10-14T18:49:02+00:00kernel-rt-kvm as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt-kvm
Red Hat · CVE-2026-74573 · Updated 2026-10-14T18:49:02+00:00kernel-selftests-internal as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-selftests-internal
Red Hat · CVE-2026-74573 · Updated 2026-10-14T18:49:02+00:00kernel-zfcpdump-devel as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-zfcpdump-devel
Red Hat · CVE-2026-74573 · Updated 2026-10-14T18:49:02+00:00python3-perf as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/python3-perf
Red Hat · CVE-2026-74573 · Updated 2026-10-14T18:49:02+00:00
All CVSS metrics
- CRITICAL 9.3 v3.1 · CNA Primary
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - CRITICAL 9.3 v3.1 · NVD Secondary
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References
Advisories
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74573.json Red Hat · CVE-2026-74573 · Updated 2026-10-14T18:49:02+00:00
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-59638 EUVD · EUVD-2026-59638
Technical & other
- https://git.kernel.org/stable/c/3808bab5d95ae79e333e11f6a73d178e084c645dCVE record · Linux · Updated 2026-08-17T05:48:52.745Z
NVD · CVE-2026-74573 · Updated 2026-10-16T20:17:38.797 - https://git.kernel.org/stable/c/0acbc621341aca4eb94d9c2f43e1ab273ff088f0CVE record · Linux · Updated 2026-08-17T05:48:52.745Z
NVD · CVE-2026-74573 · Updated 2026-10-16T20:17:38.797 - https://git.kernel.org/stable/c/c3b8ee84a965058b41275069d4696f37a8b14bf6CVE record · Linux · Updated 2026-08-17T05:48:52.745Z
NVD · CVE-2026-74573 · Updated 2026-10-16T20:17:38.797 - https://access.redhat.com/security/cve/CVE-2026-74573 Red Hat · CVE-2026-74573 · Updated 2026-10-14T18:49:02+00:00
- https://bugzilla.redhat.com/show_bug.cgi?id=2517091 Red Hat · CVE-2026-74573 · Updated 2026-10-14T18:49:02+00:00
- https://www.cve.org/CVERecord?id=CVE-2026-74573 Red Hat · CVE-2026-74573 · Updated 2026-10-14T18:49:02+00:00
- https://nvd.nist.gov/vuln/detail/CVE-2026-74573 Red Hat · CVE-2026-74573 · Updated 2026-10-14T18:49:02+00:00
- https://lore.kernel.org/linux-cve-announce/2026081555-CVE-2026-74573-d1e9@gregkh/T Red Hat · CVE-2026-74573 · Updated 2026-10-14T18:49:02+00:00
Sources: NVD · CVE.org · All sources and attribution · EPSS