Answer in brief
CVE-2024-26786 records a Unknown severity vulnerability in iommufd: Fix iopt_access_list_id overwrite bug. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=9227da7816dd1a42e20d41e2244cb63c205477ca <f1fb745ee0a6fe43f1d84ec369c7e6af2310fda9 || >=9227da7816dd1a42e20d41e2244cb63c205477ca <9526a46cc0c378d381560279bea9aa34c84298a0 || >=9227da7816dd1a42e20d41e2244cb63c205477ca <aeb004c0cd6958e910123a1607634401009c9539 | f1fb745ee0a6fe43f1d84ec369c7e6af2310fda9, 9526a46cc0c378d381560279bea9aa34c84298a0, aeb004c0cd6958e910123a1607634401009c9539 |
| Linux/Linuxgeneric | 6.6 | Not reported |
Published upstream
Apr 4, 2024
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix iopt_access_list_id overwrite bug Syzkaller reported the following WARN_ON: WARNING: CPU: 1 PID: 4738 at drivers/iommu/iommufd/io_pagetable.c:1360 Call Trace: iommufd_access_change_ioas+0x2fe/0x4e0 iommufd_access_destroy_object+0x50/0xb0 iommufd_object_remove+0x2a3/0x490 iommufd_object_destroy_user iommufd_access_destroy+0x71/0xb0 iommufd_test_staccess_release+0x89/0xd0 __fput+0x272/0xb50 __fput_sync+0x4b/0x60 __do_sys_close __se_sys_close __x64_sys_close+0x8b/0x110 do_syscall_x64 The mismatch between the access pointer in the list and the passed-in pointer is resulting from an overwrite of access->iopt_access_list_id, in iopt_add_access(). Called from iommufd_access_change_ioas() when xa_alloc() succeeds but iopt_calculate_iova_alignment() fails. Add a new_id in iopt_add_access() and only update iopt_access_list_id when returning successfully.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2024-26786 records a Unknown severity vulnerability in iommufd: Fix iopt_access_list_id overwrite bug. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=9227da7816dd1a42e20d41e2244cb63c205477ca <f1fb745ee0a6fe43f1d84ec369c7e6af2310fda9 || >=9227da7816dd1a42e20d41e2244cb63c205477ca <9526a46cc0c378d381560279bea9aa34c84298a0 || >=9227da7816dd1a42e20d41e2244cb63c205477ca <aeb004c0cd6958e910123a1607634401009c9539 | f1fb745ee0a6fe43f1d84ec369c7e6af2310fda9, 9526a46cc0c378d381560279bea9aa34c84298a0, aeb004c0cd6958e910123a1607634401009c9539 |
| Linux/Linuxgeneric | 6.6 | Not reported |
Published upstream
Apr 4, 2024
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix iopt_access_list_id overwrite bug Syzkaller reported the following WARN_ON: WARNING: CPU: 1 PID: 4738 at drivers/iommu/iommufd/io_pagetable.c:1360 Call Trace: iommufd_access_change_ioas+0x2fe/0x4e0 iommufd_access_destroy_object+0x50/0xb0 iommufd_object_remove+0x2a3/0x490 iommufd_object_destroy_user iommufd_access_destroy+0x71/0xb0 iommufd_test_staccess_release+0x89/0xd0 __fput+0x272/0xb50 __fput_sync+0x4b/0x60 __do_sys_close __se_sys_close __x64_sys_close+0x8b/0x110 do_syscall_x64 The mismatch between the access pointer in the list and the passed-in pointer is resulting from an overwrite of access->iopt_access_list_id, in iopt_add_access(). Called from iommufd_access_change_ioas() when xa_alloc() succeeds but iopt_calculate_iova_alignment() fails. Add a new_id in iopt_add_access() and only update iopt_access_list_id when returning successfully.
Quoted source text, attributed separately from HOL analysis.