Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-74355— iommu/vt-d: Fix RB-tree corruption in probe error path

AI Predicted 5.6 Difficulty: Moderate EPSS 0.17% · P6

Possible ATT&CK Techniques 1AI

T1564.004 · NTFS File Attributes

Affected Version Matrix 8

VendorProductVersion RangeStatus
LinuxLinux4f1492efb495bcef34c9ee8a94af81e6cea5abf4< f5102e0fc3c6dc8685549891a96e4589fdb3e211affected
4f1492efb495bcef34c9ee8a94af81e6cea5abf4< d16923a45d4d08367650fdc3451c89299ab6ac5aaffected
4f1492efb495bcef34c9ee8a94af81e6cea5abf4< 43bd9e6d5513cb1edbafdeef146a1edc3aaced56affected
6.15affected
< 6.15unaffected
6.18.40≤ 6.18.*unaffected
7.1.5≤ 7.1.*unaffected
7.2-rc1≤ *unaffected
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2026-74355

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
iommu/vt-d: Fix RB-tree corruption in probe error path
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix RB-tree corruption in probe error path The info->node RB-tree member is zero-initialized via kzalloc. If a device does not support ATS, the device_rbtree_insert() call is skipped. If a subsequent probe step fails, the error path jumps to device_rbtree_remove(), which misinterprets the zeroed node as a tree root and corrupts the device RB-tree. Fix this by explicitly initializing the RB-node as empty using RB_CLEAR_NODE() during initialization and guarding the removal with RB_EMPTY_NODE().
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

VendorProductAffected VersionsCPESubscribe
LinuxLinux 4f1492efb495bcef34c9ee8a94af81e6cea5abf4 ~ f5102e0fc3c6dc8685549891a96e4589fdb3e211 -
LinuxLinux 6.15 -

II. Public POCs for CVE-2026-74355

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-74355

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-74355 (3)

Same Patch Batch · Linux · 2026-08-15 · 848 CVEs total

CVE-2026-72255netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst
CVE-2026-72268fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe()
CVE-2026-72267fbdev: carminefb: fix potential memory leak in alloc_carmine_fb()
CVE-2026-72266fbdev: vesafb: fix memory leak in vesafb_probe()
CVE-2026-72265fbdev: nvidia: fix potential memory leak in nvidiafb_probe()
CVE-2026-72264fbdev: tridentfb: fix potential memory leak in trident_pci_probe()
CVE-2026-72262ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get
CVE-2026-72263ASoC: SOF: topology: fix memory leak in snd_sof_load_topology
CVE-2026-72261ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control
CVE-2026-72260ASoC: mediatek: mt8192: Check runtime resume during probe
CVE-2026-72259ASoC: mediatek: mt8192: Release reserved memory on cleanup
CVE-2026-72258ASoC: mediatek: mt8183: Release reserved memory on cleanup
CVE-2026-72256netfilter: xt_cluster: reject template conntracks in hash match
CVE-2026-72257ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback
CVE-2026-72245gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path
CVE-2026-72248netfilter: flowtable: support IPIP tunnel with direct xmit
CVE-2026-72247netfilter: nf_conncount: fix zone comparison in tuple dedup
CVE-2026-72246netfilter: flowtable: use correct direction to set up tunnel route
CVE-2026-72249netfilter: flowtable: use dst in this direction when pushing IPIP header
CVE-2026-72244gpu/buddy: bail out of try_harder when alignment cannot be honoured

Showing top 20 of 848 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-74355

No comments yet

Leave a comment