CVE-2026-74629
Received Received - Intake

Use-After-Free in Linux Kernel dibs Subsystem

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net/dibs: Correct freeing of dmb_clientid_arr A dibs device interrupt handler can be active after dibs_dev_del() and may still access dmb_clientid_arr. (UAF) In case of a failure in dibs_dev_add() being called by dibs_lo_dev_probe() dmb_clientid_arr is freed twice (double free). Free dmb_clientid_arr in dibs_dev_release() after last reference is gone. Note that allocating in dibs_dev_add() instead of dibs_dev_alloc() is ok for now, because no dmbs can be registered before dibs_dev_add().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-74629
EUVD
EUVD-2026-64566

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free (UAF) and double-free vulnerability in the Linux kernel's dibs device driver. It occurs when a device interrupt handler remains active after the device is removed, potentially accessing freed memory. Additionally, a failure in device initialization can lead to the same memory being freed twice.

Detection Guidance

This vulnerability involves a use-after-free (UAF) and double-free issue in the Linux kernel's dibs device driver. Detection requires checking for kernel logs or crashes related to dibs device operations. Monitor for kernel oops messages or system crashes after dibs device operations. Check dmesg for errors like 'general protection fault' or 'double free detected'.

Impact Analysis

This vulnerability could allow an attacker to cause system crashes, execute arbitrary code, or escalate privileges on affected systems. It primarily affects systems using the dibs device driver in the Linux kernel.

Mitigation Strategies

Apply the latest Linux kernel security patches that address this issue. If patches are unavailable, disable the dibs module by blacklisting it in the kernel. Restart affected systems after applying fixes. Monitor vendor advisories for updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74629. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart