{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-74420","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-08-15T05:44:03.894Z","datePublished":"2026-08-15T05:59:24.704Z","dateUpdated":"2026-08-17T05:19:04.353Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-17T05:19:04.353Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/gpusvm: Reject VMAs with VM_IO or VM_PFNMAP when creating SVM ranges\n\nVMAs marked with VM_IO or VM_PFNMAP are not backed by struct page\nobjects, which GPUSVM requires in order to operate correctly. In\nparticular, get_pages() relies on hmm_range_fault() to resolve struct\npages for the target range.\n\nAttempting to create an SVM range on such VMAs results in repeated\nget_pages() failures and can lead to an infinite loop inside a driver’s\npage‑fault handler. Prevent this by rejecting ranges on VM_IO or\nVM_PFNMAP VMAs and returning -EIO."}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/drm_gpusvm.c"],"versions":[{"version":"99624bdff8670795b678eafa6509aaad3a5c0175","lessThan":"353f26c74660bcbd8d82cd76622748e14a5a5db3","status":"affected","versionType":"git"},{"version":"99624bdff8670795b678eafa6509aaad3a5c0175","lessThan":"63f443384979563f16f70420f4fa85bba31238ca","status":"affected","versionType":"git"},{"version":"99624bdff8670795b678eafa6509aaad3a5c0175","lessThan":"b82a225e57a334335a21462b75ee2223bc6efe6d","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/drm_gpusvm.c"],"versions":[{"version":"6.15","status":"affected"},{"version":"0","lessThan":"6.15","status":"unaffected","versionType":"semver"},{"version":"6.18.40","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.1.5","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.15","versionEndExcluding":"6.18.40"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.15","versionEndExcluding":"7.1.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.15","versionEndExcluding":"7.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/353f26c74660bcbd8d82cd76622748e14a5a5db3"},{"url":"https://git.kernel.org/stable/c/63f443384979563f16f70420f4fa85bba31238ca"},{"url":"https://git.kernel.org/stable/c/b82a225e57a334335a21462b75ee2223bc6efe6d"}],"title":"drm/gpusvm: Reject VMAs with VM_IO or VM_PFNMAP when creating SVM ranges","x_generator":{"engine":"bippy-1.2.0"}}}}