Race condition in Linux kernel - CVE-2026-74632
Published: August 24, 2026
Vulnerability identifier: #VU144910
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-74632
CWE-ID: CWE-362
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a race condition in mm/huge_memory.c when handling concurrent page faults and shrinker activity for the huge zero folio. A local user can trigger concurrent memory-management activity to cause a denial of service.
Only systems without CONFIG_PERSISTENT_HUGE_ZERO_FOLIO are affected.
Affected software
Linux kernel
Debian Linux
linux (Debian package)
Debian Linux
linux (Debian package)
How to mitigate CVE-2026-74632
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
linux (Debian package) - update to 6.12.105-1
linux (Debian package) - update to 6.12.105-1
External References
- https://git.kernel.org/stable/c/105d04edbec83010df5728f74d17fd9c108e7553
- https://git.kernel.org/stable/c/33192a26cddea7a7e4ca66e5c3eebd36fa8be2bb
- https://git.kernel.org/stable/c/6024f6d0d9b9ca5138bfc4ac6f6e4bdf616e42b3
- https://git.kernel.org/stable/c/9332b080ad57650d1dc582e54517f9fc78ef89cc
- https://git.kernel.org/stable/c/ab7e4b407c7f58d1a003134eff3841f303d5ccc2
- https://git.kernel.org/stable/c/f3a874a903053c53fb53ba287ea9eacda69c68e8