Use-after-free in Linux kernel - CVE-2026-74520

Vulnerability identifier: #VU143255

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-74520

CWE-ID: CWE-416

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the IOMMUFD IOPF group handling logic when processing page fault groups during device detach or HWPT replacement. A local user can trigger fault handling and later access a freed group to cause a denial of service.

The issue occurs because an accepted group can remain referenced by the IOMMUFD deliver list or response xarray after being freed through the generic pending list.

Linux kernel
Debian Linux
openEuler
Ubuntu
linux (Ubuntu package)
linux-aws (Ubuntu package)
linux-gcp (Ubuntu package)
linux-oracle (Ubuntu package)
linux-ibm (Ubuntu package)
linux-hwe-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)
bpftool
python3-perf-debuginfo
python3-perf
perf-debuginfo
perf
kernel-tools-devel
kernel-tools-debuginfo
kernel-tools
kernel-source
kernel-headers
kernel-extra-modules
kernel-devel
kernel-debugsource
kernel-debuginfo
bpftool-debuginfo
kernel
linux (Debian package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux (Ubuntu package) - update to 7.0.0-42.42
linux-aws (Ubuntu package) - update to 7.0.0-1016.17
linux-gcp (Ubuntu package) - update to 7.0.0-1016.18
linux-oracle (Ubuntu package) - update to 7.0.0-1015.16
linux-ibm (Ubuntu package) - update to 7.0.0-1017.17
linux-hwe-7.0 (Ubuntu package) - update to 7.0.0-42.42~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1017.17
bpftool - update to 6.6.0-145.3.31.162
python3-perf-debuginfo - update to 6.6.0-145.3.31.162
python3-perf - update to 6.6.0-145.3.31.162
perf-debuginfo - update to 6.6.0-145.3.31.162
perf - update to 6.6.0-145.3.31.162
kernel-tools-devel - update to 6.6.0-145.3.31.162
kernel-tools-debuginfo - update to 6.6.0-145.3.31.162
kernel-tools - update to 6.6.0-145.3.31.162
kernel-source - update to 6.6.0-145.3.31.162
kernel-headers - update to 6.6.0-145.3.31.162
kernel-extra-modules - update to 6.6.0-145.3.31.162
kernel-devel - update to 6.6.0-145.3.31.162
kernel-debugsource - update to 6.6.0-145.3.31.162
kernel-debuginfo - update to 6.6.0-145.3.31.162
bpftool-debuginfo - update to 6.6.0-145.3.31.162
kernel - update to 6.6.0-145.3.31.162
linux (Debian package) - update to 6.12.115-2

• https://git.kernel.org/stable/c/4e74a369236424114b94cf6a9f5ff9e848b430b4
• https://git.kernel.org/stable/c/6da8f37419dd4c456f26fc203f04e000186f4b3d
• https://git.kernel.org/stable/c/738e6f32e61d80b554e37015ecb7bc620b88001c

• Use-after-free in Linux kernel IOMMUFD IOPF group handling logic
• openEuler 24.03 LTS SP3 update for kernel
• Debian update for linux
• Ubuntu update for linux-oem-7.0
• Ubuntu update for linux, linux-aws, linux-gcp and more