In the Linux kernel, the following vulnerability has been resolved: iommu/iommufd: Fix IOPF group ownership UAF iopf_group_alloc() links each last-page IOPF group into the generic IOPF pending list before invoking the domain fault handler. iommufd_fault_iopf_handler() also queued an accepted group in the IOMMUFD deliver list without removing it from the generic pending list. When detach or HWPT replacement drops the device's IOPF reference count to zero, an IOMMU driver may call iopf_queue_remove_device(). That function responds to and frees groups through the generic pending list without removing the same groups from IOMMUFD's deliver list or response xarray. A later read, response, or cleanup can then access the freed group and cause a UAF. Fix this by dequeuing an accepted group from the generic pending list before IOMMUFD queues it for userspace response. Make iopf_group_response() send a response regardless of pending-list membership, so the dequeued group can still be completed by IOMMUFD.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In the Linux kernel, the following vulnerability has been resolved: iommu/iommufd: Fix IOPF group
    ownership UAF iopf_group_alloc() links each last-page IOPF group into the generic IOPF pending list before
    invoking the domain fault handler. iommufd_fault_iopf_handler() also queued an accepted group in the
    IOMMUFD deliver list without removing it from the generic pending list. When detach or HWPT replacement
    drops the device's IOPF reference count to zero, an IOMMU driver may call iopf_queue_remove_device(). That
    function responds to and frees groups through the generic pending list without removing the same groups
    from IOMMUFD's deliver list or response xarray. A later read, response, or cleanup can then access the
    freed group and cause a UAF. Fix this by dequeuing an accepted group from the generic pending list before
    IOMMUFD queues it for userspace response. Make iopf_group_response() send a response regardless of
    pending-list membership, so the dequeued group can still be completed by IOMMUFD. (CVE-2026-74520)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: iommu/iommufd: Fix IOPF group     ownership UAF iopf_group_alloc() links each last-page IOPF group into the generic IOPF pending list before     invoking the domain fault handler. iommufd_fault_iopf_handler() also queued an accepted group in the     IOMMUFD deliver list without removing it from the generic pending list. When detach or HWPT replacement     drops the device's IOPF reference count to zero, an IOMMU driver may call iopf_queue_remove_device(). That     function responds to and frees groups through the generic pending list without removing the same groups     from IOMMUFD's deliver list or response xarray. A later read, response, or cleanup can then access the     freed group and cause a UAF. Fix this by dequeuing an accepted group from the generic pending list before     IOMMUFD queues it for userspace response. Make iopf_group_response() send a response regardless of     pending-list membership, so the dequeued group can still be completed by IOMMUFD. (CVE-2026-74520)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
376443	Ubuntu 24.04 LTS / 26.04 LTS : Linux kernel vulnerabilities (USN-8959-1)	Nessus	Ubuntu Local Security Checks	Local	high
471449	Google: sys-kernel/cchost-kernel-6_12, sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_18: security update to 19999.44.21	Tenable Cloud Security	Google COS Security Checks	Local	high
471449	Google: sys-kernel/cchost-kernel-6_12, sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_18: security update to 19999.44.21	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	high
470856	Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 20085.0.0	Tenable Cloud Security	Google COS Security Checks	Local	high
470856	Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 20085.0.0	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	high
335752	Linux Distros Unpatched Vulnerability : CVE-2026-74520	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-74520

high

Tenable Plugins

high

high

high

high

high

high