CVE-2026-74439 is a CVSS 9.3 use-after-free in the Linux kernel's IOMMU subsystem, specifically in device_pasid_table_teardown(). The vulnerability stems from incorrect ordering when tearing down pasid table entries: the code clears the Present bit, performs cache invalidation, and only then zeroes the entry structure. Under VT-d spec Section 6.5.3.3, the Present bit must be cleared before any teardown operation to prevent the hardware from accessing freed memory.
What makes this CVE significant is not the technical bug — which is a well-understood ordering problem — but the process failure that allowed it to survive. Commit c1e4f1dccbe9d already fixed the identical vulnerability pattern in domain_context_clear_one() and the copied-context path. That commit explicitly documented the spec requirement and the correct operation ordering. Yet device_pasid_table_teardown(), which performs the same logical operation on a structurally similar data structure, was never converted to follow this pattern. The fix existed, the specification guidance was documented, and the anti-pattern was clearly enumerated in the commit message — but no systematic mechanism ensured the pattern was applied across all similar functions in the IOMMU layer.
This is a systematic process gap, not a coding oversight. The kernel's security fix workflow treats each CVE as an isolated event, applying the fix to the reported caller without extracting the pattern for subsystem-wide audit. When device_pasid_table_teardown() was later touched — even trivially — no one grep'd for other callers of context_clear_entry() or mapped similar teardown functions. The institutional memory existed in one commit message, but there was no searchable index linking the pattern to structurally equivalent code.
Audit all callers of context_clear_entry() and equivalent IOMMU teardown primitives for the Present-bit-before-teardown ordering requirement. Review any functions in the IOMMU subsystem modified after c1e4f1dccbe9d for residual anti-patterns. Consider whether security fixes that address spec-identified patterns should generate enumerated call-site documentation in the commit message — creating a version-controlled artifact that future reviewers can grep rather than relying on informal knowledge transfer. The CVSS 9.3 adequately reflects the technical severity, but the root cause is a process gap: a documented, spec-aligned fix existed but was not systematically applied across the subsystem.