CVE-2026-74420 drm/gpusvm: Reject VMAs with VM_IO or VM_PFNMAP when creating SVM ranges
A local attacker can cause a denial of service by triggering an infinite loop in the GPU SVM page-fault handler via invalid VMAs.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-74420?
CVE-2026-74420 is a denial of service vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
drm/gpusvm: Reject VMAs with VM_IO or VM_PFNMAP when creating SVM ranges
VMAs marked with VM_IO or VM_PFNMAP are not backed by struct page objects, which GPUSVM requires in order to operate correctly. In particular, get_pages() relies on hmm_range_fault() to resolve struct pages for the target range.
Attempting to create an SVM range on such VMAs results in repeated get_pages() failures and can lead to an infinite loop inside a driver’s page‑fault handler. Prevent this by rejecting ranges on VM_IO or VM_PFNMAP VMAs and returning -EIO.
Which versions are affected by CVE-2026-74420?
How do I fix CVE-2026-74420?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-74420 being exploited?
There is no known exploitation of CVE-2026-74420 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-74420, DEBIAN-CVE-2026-74420, GHSA-rwh9-4wc5-hmq7, UBUNTU-CVE-2026-74420.