Linux kernel (drivers/iommu): Every peer-to-peer segment in a scatter-gather list inherits the length of the first

CVSS 8.8CVE-2026-74277Kernel, userspace & hypervisorcurated

Impact

Every peer-to-peer segment in a scatter-gather list inherits the length of the first segment, so the IOMMU is programmed with DMA lengths that do not match the actual buffers. Devices read and write past the end of short segments and silently truncate long ones - cross-buffer memory corruption on exactly the peer-to-peer path that GPUDirect and GPU-to-NIC traffic runs over.

Who can reach it

Any workload that drives PCI peer-to-peer DMA through dma_map_sg reaches this: GPUDirect RDMA from a tenant holding /dev/infiniband/uverbs* plus /dev/dri/renderD*, NVMe peer-to-peer, or GPU-to-NIC staging. No elevated privilege is required and no unusual configuration beyond PCI P2PDMA being in use with multi-segment scatterlists, which is the normal case for large transfers.

What to do

Update to a stable kernel carrying commits 8646f00c / db50fb87 (no fixed-version list was published by the kernel CNA - confirm the backport with your distro). Interim: disable PCI P2PDMA / GPUDirect peer-to-peer for tenant workloads if your stack allows it, since the corruption only occurs on the P2PDMA branch of iommu_dma_map_sg().

References

https://git.kernel.org/stable/c/8646f00ce021e49f4f05bc1d4060a0c27b25d0e1 https://git.kernel.org/stable/c/db50fb87015b955a5a0c155293b2dd40d63a3b9e https://nvd.nist.gov/vuln/detail/CVE-2026-74277

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.