---
id: CVE-2026-74380
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  gpu: host1x: Fix iommu_map_sgtable() return value check

  Commit "iommu: return full error code from iommu_map_sg[_atomic]()"
  changed iommu_map_sgtable() to return an ss…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  gpu: host1x: Fix iommu_map_sgtable() return value check

  Commit "iommu: return full error code from iommu_map_sg[_atomic]()"
  changed iommu_map_sgtable() to return an ss…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'
cwe:
  - CWE-190
vendor: Red Hat
product: Red Hat Enterprise Linux 9
affected:
  - enterprise_linux 10
  - enterprise_linux 9
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T19:17:42.997'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-74380'
references:
  - url: 'https://git.kernel.org/stable/c/18f74762013a4b6aa6f905c4459e0f506f9c5c7b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/2a68928c445138961e2c451983b473aeb3f5b999'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/3ac173e46ef6fda9c9df8d47cdff4df962df9728'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/5f3985c2a500df3126cb12a2e0ccf26a40bc495d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/79240eee5a40014d9edfabe19f06b35ffa84e5f8'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e024c7993d839503d6c1f0044b8fc537c30300e9'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74380.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-74380'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2516798'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-74380'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-74380'
  - url: >-
      https://lore.kernel.org/linux-cve-announce/2026081505-CVE-2026-74380-1dbd@gregkh/T
tags:
  - nvd
  - csaf
  - vex
  - red-hat
  - cve.org
  - score-dispute
epss: 0.00176
epssPercentile: 0.07138
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T18:54:56.549536Z'
scores:
  nvd: 8.8
  vendor: 5.5
  cna: 8.8
ingestedAt: '2026-10-16T19:46:24.371Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

gpu: host1x: Fix iommu_map_sgtable() return value check

Commit "iommu: return full error code from iommu_map_sg[_atomic]()"
changed iommu_map_sgtable() to return an ssize_t and negative values
in error cases, rather than a size_t and a zero.

pin_job() also was incorrectly assigning to 'int', which could cause
overflows into negative values.

Update pin_job() to correctly check for errors from iommu_map_sgtable.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · updated 2026-10-17 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74380.json)