CVE-2026-74520

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> iommu/iommufd: Fix IOPF group ownership UAF<br /> <br /> iopf_group_alloc() links each last-page IOPF group into the generic IOPF<br /> pending list before invoking the domain fault handler.<br /> iommufd_fault_iopf_handler() also queued an accepted group in the<br /> IOMMUFD deliver list without removing it from the generic pending list.<br /> <br /> When detach or HWPT replacement drops the device&amp;#39;s IOPF reference count<br /> to zero, an IOMMU driver may call iopf_queue_remove_device(). That<br /> function responds to and frees groups through the generic pending list<br /> without removing the same groups from IOMMUFD&amp;#39;s deliver list or response<br /> xarray. A later read, response, or cleanup can then access the freed<br /> group and cause a UAF.<br /> <br /> Fix this by dequeuing an accepted group from the generic pending list<br /> before IOMMUFD queues it for userspace response.<br /> Make iopf_group_response() send a response regardless of pending-list<br /> membership, so the dequeued group can still be completed by IOMMUFD.