CVE-2026-74355
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
In the Linux kernel, the iommu/vt-d subsystem has a bug causing RB-tree corruption in the probe error path. If a device does not support ATS, the RB node remains zeroed, and on a subsequent probe failure, the removal misinterprets it as a tree root, corrupting the tree.
Risk Assessment
RB-tree corruption can lead to system crashes, incorrect memory management, or potential exploitation by a local attacker.
Recommendation
Apply the kernel patch that initializes the RB node as empty and guards the removal against misinterpretation. Update the system to a kernel version with the fix.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix RB-tree corruption in probe error path The info->node RB-tree member is zero-initialized via kzalloc. If a device does not support ATS, the device_rbtree_insert() call is skipped. If a subsequent probe step fails, the error path jumps to device_rbtree_remove(), which misinterprets the zeroed node as a tree root and corrupts the device RB-tree. Fix this by explicitly initializing the RB-node as empty using RB_CLEAR_NODE() during initialization and guarding the removal with RB_EMPTY_NODE().