CVE-2026-74690 in Linux
Summary
by MITRE • 08/22/2026
In the Linux kernel, the following vulnerability has been resolved:
s390/ism: Fix UAF of sba and ieq during ism_dev_exit()
A ism interrupt handler can be active in parallel with ism_dev_exit(), accessing freed data structures.
No new interrupts will be generated after unregister_ieq(). Drain ongoing interrupt handlers by free_irq(), before freeing ism data structures.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/22/2026
The Linux kernel vulnerability identified as a use-after-free issue within the s390 Integrated Shared Memory subsystem involves a critical race condition between device exit procedures and active interrupt handling mechanisms. Specifically, during the execution of the ism_dev_exit function, which is responsible for tearing down an ISM device instance, there exists a window where previously allocated data structures such as the SBA (Shared Buffer Area) and IEQ (Interrupt Event Queue) are deallocated while they may still be accessed by concurrent interrupt handlers. This scenario arises because the unregistration of the interrupt event queue via unregister_ieq does not immediately halt all in-flight or pending interrupts that were already dispatched to the CPU before the unregistration call took effect. Consequently, if an interrupt handler is actively executing or scheduled on a parallel processor core at the moment these memory structures are freed, it will attempt to dereference pointers pointing to invalid memory regions, leading to undefined behavior and potential system instability.
From a technical perspective, this flaw represents a classic synchronization error where resource lifecycle management fails to account for asynchronous execution contexts. The root cause lies in the ordering of operations within the device removal path. While unregister_ieq effectively prevents new interrupts from being generated by the hardware or kernel subsystems, it does not provide a mechanism to wait for currently executing interrupt service routines to complete their processing. Without an explicit synchronization step to drain these ongoing handlers, the kernel proceeds to free the underlying memory buffers too early. This results in a use-after-free condition where the CPU continues to execute code that relies on data structures that have already been returned to the system allocator and potentially overwritten by other allocations. Such conditions are particularly dangerous as they can lead to kernel panics, information disclosure if sensitive data is read from reused memory pages, or arbitrary code execution if an attacker can influence what gets allocated in those freed regions through heap spraying techniques.
The operational impact of this vulnerability extends beyond simple system crashes. In a production environment involving s390 mainframe systems utilizing ISM for high-performance inter-process communication and shared memory operations, such instability could disrupt critical workloads that depend on low-latency messaging between virtual machines or containers. The unpredictability introduced by race conditions makes the issue difficult to reproduce consistently, often manifesting only under heavy load or specific timing scenarios where interrupt preemption aligns unfavorably with device teardown sequences. For organizations relying on these systems for enterprise-grade applications, this vulnerability poses a significant risk to availability and integrity, potentially requiring unplanned maintenance windows to reboot affected nodes if a crash occurs during routine service restarts or updates that trigger the exit path of ISM devices.
To mitigate this vulnerability, the resolution involves modifying the device exit sequence to ensure strict serialization between interrupt handler completion and memory deallocation. The fix mandates calling free_irq after unregister_ieq but crucially before freeing the associated data structures like sba and ieq. This ensures that any interrupts already in flight are allowed to complete their execution safely while the relevant memory remains valid, thereby eliminating the window of opportunity for a use-after-free exploit. From a defensive coding standpoint, this aligns with best practices for handling asynchronous resources in kernel space, emphasizing the need to explicitly synchronize with all active contexts before releasing shared state. Security teams should verify that systems running affected versions of the Linux kernel are patched promptly, as unpatched kernels remain susceptible to local privilege escalation or denial-of-service attacks triggered by triggering device removal events while interrupts are active. This issue is categorized under CWE-416 Use After Free and relates to ATT&CK techniques involving exploitation for initial access or persistence if leveraged in conjunction with other vulnerabilities within the same subsystem.