CVE-2026-31735

iommupt: Fix short gather if the unmap goes into a large mapping

Published May 1, 2026 CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

iommupt: Fix short gather if the unmap goes into a large mapping

unmap has the odd behavior that it can unmap more than requested if the
ending point lands within the middle of a large or contiguous IOPTE.

In this case the gather should flush everything unmapped which can be
larger than what was requested to be unmapped. The gather was only
flushing the range requested to be unmapped, not extending to the extra
range, resulting in a short invalidation if the caller hits this special
condition.

This was found by the new invalidation/gather test I am adding in
preparation for ARMv8. Claude deduced the root cause.

As far as I remember nothing relies on unmapping a large entry, so this is
likely not a triggerable bug.

Analysis

Technical impact

The Linux kernel’s iommupt unmap routine can leave portions of a large IOPTE unmapped when the requested unmap range ends inside a contiguous mapping. The code flushes only the requested area, not the extra overlap, resulting in a short invalidation. This flaw does not expose obvious information leakage or direct code execution paths, but it could leave stale mappings that might cause undefined behavior if later accessed.

Affected Systems

The vulnerability affects all Linux kernels that include the iommupt unmap path; no specific product or version was listed in the CNA data.

Risk and Exploitability

The CVSS score is 8.8, and the EPSS score is less than 1%. The vulnerability is not currently listed in the CISA KEV catalog, and the description states that nothing depends on large-entry unmapping, implying low likelihood of exploitation. The potential impact is limited to kernel stability and unlikely to be triggerable by user‑space applications.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`7c53f4238aa8bfb476e177263133ead2eeb8d55d`	affected	< 50ecd96a28f712f8b682c0441f4cb9b086d28816
`7c53f4238aa8bfb476e177263133ead2eeb8d55d`	affected	< ee6e69d032550687a3422504bfca3f834c7b5061

Linux

affected

Version	Status	Constraints
`6.19`	affected	—
`0`	unaffected	< 6.19
`6.19.12`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc1::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc2::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc3::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc4::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc5::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc6::::::

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[7c53f4238aa8bfb476e177263133ead2eeb8d55d,50ecd96a28f712f8b682c0441f4cb9b086d28816)`	affected	code_commit	—
`[7c53f4238aa8bfb476e177263133ead2eeb8d55d,ee6e69d032550687a3422504bfca3f834c7b5061)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`6.19`	affected	generic	—
`[0,6.19)`	unaffected	generic	—
`[6.19.12,6.20.0)`	unaffected	semver	—
`[7.0,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the kernel to a version that includes the commit associated with the fix (e.g., the commit referenced in the provided Git links).
Verify that the kernel’s IOMMU drivers and related modules use only the corrected unmap behaviour in test environments, especially with large or contiguous IOPTEs.
Monitor system stability and IOMMU logs for unexpected behaviour; ensure that no legacy code or drivers invoke unmap on large mappings that could trigger the condition.

Generated by OpenCVE AI on May 7, 2026 at 18:52 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.120% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/50ecd96a28f712f8b682c0441f4cb9b086d28816
https://git.kernel.org/stable/c/ee6e69d032550687a3422504bfca3f834c7b5061
https://lore.kernel.org/linux-cve-announce/2026050138-CVE-2026-31735-436c@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-31735
https://www.cve.org/CVERecord?id=CVE-2026-31735

History

May 7, 2026 5:00 PM Weaknesses updated. Affected versions updated View changes

Type	Values Removed	Values Added
Weaknesses		NVD-CWE-noinfo
CPEs		cpe:2.3:o:linux:linux_kernel:7.0:rc1:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc2:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc3:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc4:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc5:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc6::::::

May 3, 2026 6:30 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}`

May 2, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-459
References		https://lore.kernel.org/linux-cve-announce/2026050138-CVE-2026-31735-436c@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-31735 https://www.cve.org/CVERecord?id=CVE-2026-31735
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

May 1, 2026 2:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: iommupt: Fix short gather if the unmap goes into a large mapping unmap has the odd behavior that it can unmap more than requested if the ending point lands within the middle of a large or contiguous IOPTE. In this case the gather should flush everything unmapped which can be larger than what was requested to be unmapped. The gather was only flushing the range requested to be unmapped, not extending to the extra range, resulting in a short invalidation if the caller hits this special condition. This was found by the new invalidation/gather test I am adding in preparation for ARMv8. Claude deduced the root cause. As far as I remember nothing relies on unmapping a large entry, so this is likely not a triggerable bug.
Title		iommupt: Fix short gather if the unmap goes into a large mapping
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/50ecd96a28f712f8b682c0441f4cb9b086d28816 https://git.kernel.org/stable/c/ee6e69d032550687a3422504bfca3f834c7b5061