Use-after-free in Linux kernel - CVE-2026-74255

Vulnerability identifier: #VU142941

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-74255

CWE-ID: CWE-416

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to execute arbitrary code or cause a denial of service.

The vulnerability exists due to use-after-free in tipc_l2_send_msg() when handling TIPC layer 2 media disable operations concurrently with RCU readers. A local user can trigger concurrent access to a freed device pointer to execute arbitrary code or cause a denial of service.

The issue is caused by a race condition involving b->media_ptr and network-device lifetime management.

Linux kernel
SUSE Linux Enterprise Server 12 SP5
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Live Patching
Ubuntu
kgraft-patch-4_12_14-122_328-default
gfs2-kmp-default
cluster-md-kmp-default-debuginfo
dlm-kmp-default-debuginfo
kernel-default-base-debuginfo
ocfs2-kmp-default
dlm-kmp-default
gfs2-kmp-default-debuginfo
ocfs2-kmp-default-debuginfo
kernel-syms
cluster-md-kmp-default
kernel-default-devel
kernel-default-base
kernel-default-devel-debuginfo
kernel-source
kernel-devel
kernel-macros
kernel-default-man
kernel-default-kgraft
kernel-default-debuginfo
kernel-default-kgraft-devel
kernel-default-debugsource
kernel-default
linux (Ubuntu package)
linux-gcp (Ubuntu package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
kgraft-patch-4_12_14-122_328-default - update to 1-8.5.1
gfs2-kmp-default - update to 4.12.14-122.328.1
cluster-md-kmp-default-debuginfo - update to 4.12.14-122.328.1
dlm-kmp-default-debuginfo - update to 4.12.14-122.328.1
kernel-default-base-debuginfo - update to 4.12.14-122.328.1
ocfs2-kmp-default - update to 4.12.14-122.328.1
dlm-kmp-default - update to 4.12.14-122.328.1
gfs2-kmp-default-debuginfo - update to 4.12.14-122.328.1
ocfs2-kmp-default-debuginfo - update to 4.12.14-122.328.1
kernel-syms - update to 4.12.14-122.328.1
cluster-md-kmp-default - update to 4.12.14-122.328.1
kernel-default-devel - update to 4.12.14-122.328.1
kernel-default-base - update to 4.12.14-122.328.1
kernel-default-devel-debuginfo - update to 4.12.14-122.328.1
kernel-source - update to 4.12.14-122.328.1
kernel-devel - update to 4.12.14-122.328.1
kernel-macros - update to 4.12.14-122.328.1
kernel-default-man - update to 4.12.14-122.328.1
kernel-default-kgraft - update to 4.12.14-122.328.1
kernel-default-debuginfo - update to 4.12.14-122.328.1
kernel-default-kgraft-devel - update to 4.12.14-122.328.1
kernel-default-debugsource - update to 4.12.14-122.328.1
kernel-default - update to 4.12.14-122.328.1
linux (Ubuntu package) - addressed in versions 7.0.0-34.34, 7.0.0-34.34.1, 7.0.0-34.34~24.04.1, 7.0.0-1012.12~24.04.1, 7.0.0-1013.13, 7.0.0-1013.13~24.04.1, 7.0.0-1014.14, 7.0.0-1020.20
linux-gcp (Ubuntu package) - addressed in versions 7.0.0-1013.13, 7.0.0-1013.13~24.04.1, 7.0.0-1014.14

• https://git.kernel.org/stable/c/0d8a12d7143126afdf9fbe2e3d438650dd6603ed
• https://git.kernel.org/stable/c/35e0297a93c3c34a3924eeef816c03504e3ab5c5
• https://git.kernel.org/stable/c/50ff092633b06382e5091dd5b093ce943d4ac2f9
• https://git.kernel.org/stable/c/609ced2301be1df7e7ed2ef47d1d916674e6ba3b
• https://git.kernel.org/stable/c/71aafa16d79b107b33837f60b6cbc7d0cb8c5708
• https://git.kernel.org/stable/c/aef12b5ce793dea6b3a97a58fd0f946000ae8945
• https://git.kernel.org/stable/c/f4002f1c669cc02e3763f479fc25ff1dfa9e2420
• https://git.kernel.org/stable/c/f4c3d89fc986b0da196ddfc6cfe0ea5d5d08bec6

• Use-after-free in Linux kernel tipc
• Ubuntu update for linux-gcp
• Ubuntu update for linux
• SUSE update for the Linux Kernel