---
id: CVE-2026-74573
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE

  arm_vsmmu_vsid_to_sid() maps a guest's vSID to a single physical Stream ID
  taken from master->st…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE

  arm_vsmmu_vsid_to_sid() maps a guest's vSID to a single physical Stream ID
  taken from master->st…
severity: critical
cvss: 9.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= d68beb276ba26cec47350a6d468e967673ee0c56 <
    3808bab5d95ae79e333e11f6a73d178e084c645d
  - >-
    Linux >= d68beb276ba26cec47350a6d468e967673ee0c56 <
    0acbc621341aca4eb94d9c2f43e1ab273ff088f0
  - >-
    Linux >= d68beb276ba26cec47350a6d468e967673ee0c56 <
    c3b8ee84a965058b41275069d4696f37a8b14bf6
  - Linux 6.13
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T20:17:38.797'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-74573'
references:
  - url: 'https://git.kernel.org/stable/c/0acbc621341aca4eb94d9c2f43e1ab273ff088f0'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/3808bab5d95ae79e333e11f6a73d178e084c645d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c3b8ee84a965058b41275069d4696f37a8b14bf6'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00194
epssPercentile: 0.08963
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T19:00:36.894843Z'
ingestedAt: '2026-10-16T19:46:24.341Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE

arm_vsmmu_vsid_to_sid() maps a guest's vSID to a single physical Stream ID
taken from master->streams[0], assuming a device has exactly one stream. A
device with several streams gets only its first one mapped, so a guest vSID
invalidation cannot reach the others' ATC and IOTLB entries; a device with
none makes master->streams a ZERO_SIZE_PTR, read out of bounds.

Add an arm_vsmmu_vdevice_init() op to reject the vDEVICE with -EOPNOTSUPP
when master->num_streams is not one, rather than mapping it silently.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.