CVE-2026-74355

A moderate severity flaw was found in the Linux kernel's Intel VT-d IOMMU driver (iommu/vt-d). The info->node RB-tree member is zero-initialized via kzalloc; when a device does not support Address Translation Services (ATS), device_rbtree_insert() is skipped, and if a subsequent device probe step fails, the error path calls device_rbtree_remove(), which misinterprets the zeroed node as a tree root and corrupts the IOMMU device RB-tree. Exploitation requires local privileged access on an Intel VT-d platform together with specific conditions (a device without ATS whose probe fails), and the verified consequence is corruption of kernel data structures leading to system instability or a denial of service. Red Hat rated this flaw Moderate (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), which is lower than the upstream CVE.org Important rating of 8.2, because the issue is local, requires privileges, and primarily affects system availability rather than confidentiality or integrity. Red Hat Enterprise Linux 9 and 10 streams that contain the vulnerable code (RHEL 9.8.z, RHEL 9.9, RHEL 10.2.z, and RHEL 10.3 kernel and kernel-rt, and Red Hat In-Vehicle OS 2.0 and 2.1 kernels) are affected; the fix for these streams is currently deferred to a future update, so the residual risk remains a local denial of service on affected systems. Earlier RHEL 6, 7, 8, and earlier RHEL 9 and 10 update streams do not contain the vulnerable code and are therefore not affected.