Use-after-free in Linux kernel - CVE-2026-74482

Vulnerability details

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in __folio_split() in mm/huge_memory.c when handling a split of a shmem transparent huge page during memory failure processing and truncation. A local user can trigger the vulnerable split path to cause a denial of service.

The issue can occur when a poisoned tail beyond EOF is split while truncation and a concurrent final iput() allow the inode to be evicted and RCU-freed before i_mmap_unlock_read() is reached.

Affected software

How to mitigate CVE-2026-74482

External References

• https://git.kernel.org/stable/c/10065fb891651d9541e7a5a2db84c1e656ece4f9
• https://git.kernel.org/stable/c/be106f7855f03d3128ed0ce70ba74b484a90b473
• https://git.kernel.org/stable/c/d640efe94d86d3be893d4c19220362546a637e90
• https://git.kernel.org/stable/c/e3dd774dbfd0b5bc2dbd0995221751b1234f8205
• https://git.kernel.org/stable/c/e923bd21058ea02fd0dcd3549d151d143fd036e5

Related Security Bulletins

• Use-after-free in Linux kernel mm
• Debian update for linux