CVE-2026-74713: vhost_iotlb: bound map allocation in add_range

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

vhost_iotlb: bound map allocation in add_range

vhost_iotlb_add_range_ctx() only retires an old entry when the table
has a non-zero limit, has exactly reached that limit and has
VHOST_IOTLB_FLAG_RETIRE set. Non-retiring tables can keep allocating
entries after reaching their configured limit.

Existing vhost devices allocate their IOTLB with max_iotlb_entries from
vhost.c, which defaults to 2048 and is tunable by module parameter. Use
the caller-provided limit at the allocation point instead of adding a
separate default in the common IOTLB helper, and reject non-positive
values in vhost paths that can report an error.

Other vhost IOTLB users should not create zero-limit tables when entries
can be populated from userspace or guest-controlled requests. Add
caller-side max_iotlb_entries parameters for mlx5 vDPA, VDUSE and
vhost-vDPA. Reject non-positive VDUSE and vhost-vDPA values, and require
at least two entries for vdpa_sim and mlx5 vDPA paths that install
full-range mappings, since those mappings are split into two IOTLB
entries.

Handle full-range mappings in the common helper by checking that the
IOTLB can hold both split entries before inserting the first half. This
avoids returning an error after leaving a half mapping behind.

When the table is full, keep the existing retire behavior for retiring
tables and return -ENOSPC for non-retiring tables. Reuse the retired map
node instead of freeing it and allocating a replacement, so a stream of
IOTLB updates cannot keep forcing GFP_ATOMIC allocations after the table
has reached its limit. If a zero-limit IOTLB still reaches the common
helper, treat it as a configuration error and return -EINVAL.

I found this bug myself, though the patch was written with AI assistance.

The Linux kernel CVE team has assigned CVE-2026-74713 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.7 with commit 0bbe30668d89ec8a309f28ced6d092c90fb23e8c and fixed in 7.1.9 with commit ae128dd19040ee06a4f8143c7ced4d18080d7a9a
	Issue introduced in 5.7 with commit 0bbe30668d89ec8a309f28ced6d092c90fb23e8c and fixed in 7.2 with commit 1ed35ac7f3fe2b4396bdd29ac3a7f0ebc0829e94

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-74713
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/vdpa/mlx5/core/mlx5_vdpa.h
	drivers/vdpa/mlx5/core/mr.c
	drivers/vdpa/mlx5/core/resources.c
	drivers/vdpa/vdpa_sim/vdpa_sim.c
	drivers/vdpa/vdpa_user/iova_domain.c
	drivers/vhost/iotlb.c
	drivers/vhost/vdpa.c
	drivers/vhost/vhost.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/ae128dd19040ee06a4f8143c7ced4d18080d7a9a
	https://git.kernel.org/stable/c/1ed35ac7f3fe2b4396bdd29ac3a7f0ebc0829e94