Answer in brief
CVE-2024-26786 records a High severity (CVSS 7.8) vulnerability in iommufd: Fix iopt_access_list_id overwrite bug. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=9227da7816dd1a42e20d41e2244cb63c205477ca <f1fb745ee0a6fe43f1d84ec369c7e6af2310fda9 || >=9227da7816dd1a42e20d41e2244cb63c205477ca <9526a46cc0c378d381560279bea9aa34c84298a0 || >=9227da7816dd1a42e20d41e2244cb63c205477ca <aeb004c0cd6958e910123a1607634401009c9539 | f1fb745ee0a6fe43f1d84ec369c7e6af2310fda9, 9526a46cc0c378d381560279bea9aa34c84298a0, aeb004c0cd6958e910123a1607634401009c9539 |
| Linux/Linuxgeneric | 6.6 | Not reported |
Published upstream
Apr 4, 2024
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix iopt_access_list_id overwrite bug Syzkaller reported the following WARN_ON: WARNING: CPU: 1 PID: 4738 at drivers/iommu/iommufd/io_pagetable.c:1360 Call Trace: iommufd_access_change_ioas+0x2fe/0x4e0 iommufd_access_destroy_object+0x50/0xb0 iommufd_object_remove+0x2a3/0x490 iommufd_object_destroy_user iommufd_access_destroy+0x71/0xb0 iommufd_test_staccess_release+0x89/0xd0 __fput+0x272/0xb50 __fput_sync+0x4b/0x60 __do_sys_close __se_sys_close __x64_sys_close+0x8b/0x110 do_syscall_x64 The mismatch between the access pointer in the list and the passed-in pointer is resulting from an overwrite of access->iopt_access_list_id, in iopt_add_access(). Called from iommufd_access_change_ioas() when xa_alloc() succeeds but iopt_calculate_iova_alignment() fails. Add a new_id in iopt_add_access() and only update iopt_access_list_id when returning successfully.
Quoted source text, attributed separately from HOL analysis.