SB2026082497 - Improper resource shutdown or release in Linux kernel mm

Description

This security bulletin contains information about 1 vulnerability.

1) Improper resource shutdown or release (CVE-ID: CVE-2026-74674)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in zap_pte_range in mm/memory.c when reclaiming direct page tables. A local user can trigger memory-management activity that causes a page table to be freed after flushing the wrong address to cause a denial of service.

The issue occurs because the TLB or paging-structure-cache may retain a reference to an empty page table that is later freed and possibly reused, and speculative cache fills can contribute to triggering the condition.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/0b8ff21cbda8808c86b18f1b0ca2d0025af9a80a
• https://git.kernel.org/stable/c/478a1c3abebfc717db0d1281a9cdd7befafee542