{"id":"CVE-2026-74420","state":"PUBLISHED","title":"drm/gpusvm: Reject VMAs with VM_IO or VM_PFNMAP when creating SVM ranges","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/gpusvm: Reject VMAs with VM_IO or VM_PFNMAP when creating SVM ranges\n\nVMAs marked with VM_IO or VM_PFNMAP are not backed by struct page\nobjects, which GPUSVM requires in order to operate correctly. In\nparticular, get_pages() relies on hmm_range_fault() to resolve struct\npages for the target range.\n\nAttempting to create an SVM range on such VMAs results in repeated\nget_pages() failures and can lead to an infinite loop inside a driver’s\npage‑fault handler. Prevent this by rejecting ranges on VM_IO or\nVM_PFNMAP VMAs and returning -EIO.","publishedAt":"2026-08-15T05:59:24.704Z","updatedAt":"2026-08-17T05:19:04.353Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"99624bdff8670795b678eafa6509aaad3a5c0175","status":"affected","lessThan":"353f26c74660bcbd8d82cd76622748e14a5a5db3","versionType":"git"},{"version":"99624bdff8670795b678eafa6509aaad3a5c0175","status":"affected","lessThan":"63f443384979563f16f70420f4fa85bba31238ca","versionType":"git"},{"version":"99624bdff8670795b678eafa6509aaad3a5c0175","status":"affected","lessThan":"b82a225e57a334335a21462b75ee2223bc6efe6d","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/drm_gpusvm.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.15","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.15","versionType":"semver"},{"version":"6.18.40","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.5","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/drm_gpusvm.c"]}],"references":["https://git.kernel.org/stable/c/353f26c74660bcbd8d82cd76622748e14a5a5db3","https://git.kernel.org/stable/c/63f443384979563f16f70420f4fa85bba31238ca","https://git.kernel.org/stable/c/b82a225e57a334335a21462b75ee2223bc6efe6d"],"weaknesses":[],"ingestedAt":"2026-10-29T20:12:58.252Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/74xxx/CVE-2026-74420.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-74420","state":"PUBLISHED","datePublished":"2026-08-15T05:59:24.704Z","dateUpdated":"2026-08-17T05:19:04.353Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-08-15T05:44:03.894Z"},"containers":{"cna":{"title":"drm/gpusvm: Reject VMAs with VM_IO or VM_PFNMAP when creating SVM ranges","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/gpusvm: Reject VMAs with VM_IO or VM_PFNMAP when creating SVM ranges\n\nVMAs marked with VM_IO or VM_PFNMAP are not backed by struct page\nobjects, which GPUSVM requires in order to operate correctly. In\nparticular, get_pages() relies on hmm_range_fault() to resolve struct\npages for the target range.\n\nAttempting to create an SVM range on such VMAs results in repeated\nget_pages() failures and can lead to an infinite loop inside a driver’s\npage‑fault handler. Prevent this by rejecting ranges on VM_IO or\nVM_PFNMAP VMAs and returning -EIO."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"99624bdff8670795b678eafa6509aaad3a5c0175","status":"affected","lessThan":"353f26c74660bcbd8d82cd76622748e14a5a5db3","versionType":"git"},{"version":"99624bdff8670795b678eafa6509aaad3a5c0175","status":"affected","lessThan":"63f443384979563f16f70420f4fa85bba31238ca","versionType":"git"},{"version":"99624bdff8670795b678eafa6509aaad3a5c0175","status":"affected","lessThan":"b82a225e57a334335a21462b75ee2223bc6efe6d","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/drm_gpusvm.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.15","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.15","versionType":"semver"},{"version":"6.18.40","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.5","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/drm_gpusvm.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/353f26c74660bcbd8d82cd76622748e14a5a5db3"},{"url":"https://git.kernel.org/stable/c/63f443384979563f16f70420f4fa85bba31238ca"},{"url":"https://git.kernel.org/stable/c/b82a225e57a334335a21462b75ee2223bc6efe6d"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-17T05:19:04.353Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.15","versionEndExcluding":"6.18.40"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.15","versionEndExcluding":"7.1.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.15","versionEndExcluding":"7.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}