CVE-2026-74355 Linux CVE debrief

Who should care

Linux kernel developers, administrators, and security teams responsible for maintaining and securing Linux-based systems should assess exposure and prioritize patching for affected versions. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Linux kernel developers and security teams should also monitor for potential corruption in Linux kernel systems.

Why it matters

CVE-2026-74355 is a Linux kernel vulnerability that allows RB-tree corruption in the iommu/vt-d probe error path. Linux kernel developers, administrators, and security teams should assess exposure and prioritize patching for affected versions.

• Potential RB-tree corruption in iommu/vt-d probe error path
• Required patching for affected Linux kernel versions
• Monitoring for potential corruption in Linux kernel systems

Technical summary

The Linux kernel vulnerability CVE-2026-74355 occurs in the iommu/vt-d subsystem, specifically in the probe error path. When a device does not support ATS and a subsequent probe step fails, the error path misinterprets a zeroed node as a tree root, causing RB-tree corruption. The vulnerability impacts Linux kernel developers, administrators, and security teams responsible for maintaining and securing Linux-based systems. They should assess exposure and prioritize patching for affected versions. The issue is caused by the info->node RB-tree member being zero-initialized via kzalloc. If a device does not support ATS, the device_rbtree_insert() call is skipped.

Defensive priority

Assess Linux kernel exposure, prioritize patching for affected versions, and monitor for potential corruption.

Recommended defensive actions

• Assess exposure of Linux kernel versions 6.15 and prior
• Prioritize patching for affected Linux kernel versions
• Monitor Linux kernel systems for potential RB-tree corruption
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, while references offer additional technical context. The vulnerability has been resolved in the Linux kernel. There are no known exploits, but defenders should verify affected scope and severity. Linux kernel developers, administrators, and security teams should assess exposure and prioritize patching for affected versions. The CVE Program record and NVD vulnerability detail provide official information on the vulnerability. Additional technical context is available

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.