Use-after-free in Linux kernel - CVE-2026-74672

Vulnerability details

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to a use-after-free in kernel page table walking and vmap huge page table promotion logic when page tables are freed concurrently with debugging page table walks. A local user can trigger concurrent page table operations to cause a denial of service or execute arbitrary code.

The issue occurs because ptdump walks kernel page table ranges it does not own while huge vmap promotion can free lower page tables during the walk.

Affected software

How to mitigate CVE-2026-74672

External References

• https://git.kernel.org/stable/c/26444eb71465c9934d9d418ef69c43f61185329b
• https://git.kernel.org/stable/c/39c6772b56a6bbdd62794833f74232971d94d7c9
• https://git.kernel.org/stable/c/3cc26c8907db0f5d1ff8043b5851ee572e9b3c98
• https://git.kernel.org/stable/c/7ac8a333dd41ba5e1b4e8c6edbc48b15446c5468
• https://git.kernel.org/stable/c/8d7f560f4b0482d469de962fbe4b59c37561052e
• https://git.kernel.org/stable/c/c5bf8cd148cfea948cfa3db71da427294b20db0f

Related Security Bulletins

• Use-after-free in Linux kernel mm
• Debian update for linux