CVE-2026-74277
In the Linux kernel, the following vulnerability has been resolved: iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path In iommu_dma_map_sg(), when…
Published Aug 15, 2026 · updated Oct 15, 2026
In the Linux kernel, the following vulnerability has been resolved: iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path In iommu_dma_map_sg(), when handling PCI P2PDMA cases, the DMA length of the current scatterlist segment is incorrectly assigned from the head entry instead of the current entry . This typo causes all P2PDMA segments in the scatterlist to inherit the length of the first segment, leading to corrupted DMA lengths for multi- segment scatterlists. Fix this by using instead of .
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Aug 15, 2026 · NIST NVD
Detected
In the Linux kernel, the following vulnerability has been resolved: iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path In iommu_dma_map_sg(), when handling PCI P2PDMA cases, the DMA length of the current scatterlist segment is incorrectly assigned from the head entry instead of the current entry . This typo causes all P2PDMA segments in the scatterlist to inherit the length of
Oct 15, 2026 · NIST NVD
Updated
In the Linux kernel, the following vulnerability has been resolved: iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path In iommu_dma_map_sg(), when handling PCI P2PDMA cases, the DMA length of the current scatterlist segment is incorrectly assigned from the head entry instead of the current entry . This typo causes all P2PDMA segments in the scatterlist to inherit the length of
Sources
- CVE.orgVulnerability recordCVE-2026-74277
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-74277
30-day exploitation probability 0.2%
first.org - NIST NVDVulnerability recordCVE-2026-74277
In the Linux kernel, the following vulnerability has been resolved: iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path In iommu_dma_map_sg(), when handling PCI P2PDMA cases, the DMA length of the current scatterlist segment is incorrectly assigned from
nvd.nist.gov