CVE-2026-74277

This CVE exposes a two-line typo in iommu_dma_map_sg() that silently corrupts scatterlist length values in P2PDMA (peer-to-peer DMA) operations. The bug assigns sg->length to s->length across every segment, discarding the actual length of each scatterlist entry after the first and replacing it with a static value. This is not a bounds check failure or null dereference — it is a structural corruption mechanism that will produce invalid DMA mappings, potentially triggering buffer overruns or corrupted read/write payloads on the receiving end. The critical tension here is the CVSS-EPSS gap: CVSS 8.8 reflects genuine potential impact, but EPSS of 0.00154 correctly signals that this lives in deep IOMMU internals with constrained current blast radius. P2PDMA paths — used for GPU interconnects, RDMA, and NVLink transfers — are niche in production, and the code path only triggers with multi-segment scatterlists. Most systems simply won't exercise this code. However, three factors should keep this on your radar. First, the bug likely predates modern P2PDMA infrastructure — it was probably copied from conventional DMA paths when peer-to-peer support was added in kernel 5.3 (2019), meaning it has existed through six years of expanding GPU compute deployments. Second, the error handling in iommu_dma_map_sg() may not catch length corruption, allowing corrupted descriptors to queue to hardware silently — the worst failure mode for HPC and financial workloads where crashes are preferable to silent data corruption. Third, this is the fourth identifiable scatterlist length corruption bug in kernel DMA code over the past decade; the iteration pattern that created it is likely replicated elsewhere. If you maintain P2PDMA infrastructure, audit your kernel version and check whether multi-segment peer transfers are in your hot path. The fix is trivial; the discovery cost is not. The debugging asymmetry here is severe — GPU and RDMA engineers tracing intermittent data corruption will likely suspect hardware long before tracing a two-line typo in an obscure IOMMU helper.

Reviewed through automated stages and approved by a human before publication.