CVE-2026-74690

Received Received - Intake

Use-After-Free in Linux Kernel s390/ism Driver

Publication date: 2026-08-22

Last updated on: 2026-08-25

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: s390/ism: Fix UAF of sba and ieq during ism_dev_exit() A ism interrupt handler can be active in parallel with ism_dev_exit(), accessing freed data structures. No new interrupts will be generated after unregister_ieq(). Drain ongoing interrupt handlers by free_irq(), before freeing ism data structures.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-22

Last Modified

2026-08-25

Generated

2026-09-12

AI Q&A

2026-08-22

EPSS Evaluated

2026-09-10

NVD

CVE-2026-74690

EUVD

EUVD-2026-64377

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free (UAF) vulnerability in the Linux kernel's s390/ism driver. It occurs when an interrupt handler continues running after the device is being removed, accessing memory that has already been freed. The issue happens because ongoing interrupt handlers are not properly drained before freeing the device's data structures.

Detection Guidance

This vulnerability involves a use-after-free (UAF) condition in the Linux kernel's s390/ism driver. Detection requires checking for kernel logs or crashes related to the ism driver, particularly during device unloading or interrupt handling. Monitor for messages like 'ism' or 'sba' in kernel logs. No specific commands are provided in the context to directly detect this issue.

Impact Analysis

This vulnerability could lead to system crashes, data corruption, or privilege escalation if exploited. Attackers might trigger the UAF to execute arbitrary code in the kernel context, potentially gaining full control over the affected system.

Compliance Impact

This vulnerability does not provide specific information about compliance impacts on standards like GDPR or HIPAA. The issue involves a use-after-free condition in the Linux kernel's s390/ism driver, which could lead to system instability or crashes but lacks details on data exposure or privacy implications.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve the UAF issue in the s390/ism driver. Ensure the fix for sba and ieq handling during ism_dev_exit() is applied.

Hi! I’m here to help you understand CVE-2026-74690. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70