GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-74629 (GCVE-0-2026-74629)

Vulnerability from cvelistv5 – Published: 2026-08-22 15:32 – Updated: 2026-08-25 05:40
VLAI
Title
net/dibs: Correct freeing of dmb_clientid_arr
Summary
In the Linux kernel, the following vulnerability has been resolved: net/dibs: Correct freeing of dmb_clientid_arr A dibs device interrupt handler can be active after dibs_dev_del() and may still access dmb_clientid_arr. (UAF) In case of a failure in dibs_dev_add() being called by dibs_lo_dev_probe() dmb_clientid_arr is freed twice (double free). Free dmb_clientid_arr in dibs_dev_release() after last reference is gone. Note that allocating in dibs_dev_add() instead of dibs_dev_alloc() is ok for now, because no dmbs can be registered before dibs_dev_add().
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: cc21191b584c6f7836b0f10774f8278b7cbfba10 , < ece6426b61241e9bfb41aa131f235168f55229b1 (git)
Affected: cc21191b584c6f7836b0f10774f8278b7cbfba10 , < 7a1df20a8d2cc89e3a442b6e0b43b1cacde8d403 (git)
Affected: cc21191b584c6f7836b0f10774f8278b7cbfba10 , < 9e6869be49064915edb6c8776b27c376cfdb0df5 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.18
Unaffected: 0 , < 6.18 (semver)
Unaffected: 6.18.45 , ≤ 6.18.* (semver)
Unaffected: 7.1.9 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/dibs/dibs_loopback.c",
            "drivers/dibs/dibs_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ece6426b61241e9bfb41aa131f235168f55229b1",
              "status": "affected",
              "version": "cc21191b584c6f7836b0f10774f8278b7cbfba10",
              "versionType": "git"
            },
            {
              "lessThan": "7a1df20a8d2cc89e3a442b6e0b43b1cacde8d403",
              "status": "affected",
              "version": "cc21191b584c6f7836b0f10774f8278b7cbfba10",
              "versionType": "git"
            },
            {
              "lessThan": "9e6869be49064915edb6c8776b27c376cfdb0df5",
              "status": "affected",
              "version": "cc21191b584c6f7836b0f10774f8278b7cbfba10",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/dibs/dibs_loopback.c",
            "drivers/dibs/dibs_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "lessThan": "6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/dibs: Correct freeing of dmb_clientid_arr\n\nA dibs device interrupt handler can be active after dibs_dev_del() and\nmay still access dmb_clientid_arr. (UAF)\n\nIn case of a failure in dibs_dev_add() being called by dibs_lo_dev_probe()\ndmb_clientid_arr is freed twice (double free).\n\nFree dmb_clientid_arr in dibs_dev_release() after last reference is gone.\nNote that allocating in dibs_dev_add() instead of dibs_dev_alloc() is ok\nfor now, because no dmbs can be registered before dibs_dev_add()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The UAF is hit when an ISM interrupt handler reads dmb_clientid_arr during SMC-D data transfer from a co-located peer on the same IBM Z CPC/HiperSockets domain; this is an adjacent-network attack surface, not arbitrary Internet reachability.\nAC:L - An attacker controls the IRQ side by sustaining SMC-D transfers that keep firing ism_handle_irq while device teardown runs; no rare memory layout or victim-specific state beyond concurrent traffic during hot-unplug/module removal is required.\nPR:N - Exploitation requires only an established SMC-D peer sending data to the victim; no Linux capabilities, root, or user-namespace privileges on the victim host are needed to drive the interrupt path that accesses the freed array.\nUI:N - No victim user action is required; the bug is triggered by remote SMC-D traffic coinciding with kernel driver teardown, not by opening files, mounting filesystems, or other interactive steps.\nS:U - Successful exploitation corrupts kernel heap memory and enables privilege escalation within the same kernel security domain; it does not by itself cross a VM/hypervisor or IOMMU boundary to another authority.\nC:H - The use-after-free of dmb_clientid_arr in ism_handle_irq permits out-of-bounds or attacker-influenced kernel heap reads that can disclose sensitive memory, including pointers usable in further exploitation.\nI:H - UAF on a heap-allocated client-ID lookup table in IRQ context can be turned into arbitrary kernel memory writes and control-flow hijacking via heap grooming and reuse of the freed allocation.\nA:H - Concurrent access to freed dmb_clientid_arr during interrupt handling can cause kernel oops/panic or wedged SMC-D processing, producing complete loss of availability on affected IBM Z systems."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:40:53.253Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ece6426b61241e9bfb41aa131f235168f55229b1"
        },
        {
          "url": "https://git.kernel.org/stable/c/7a1df20a8d2cc89e3a442b6e0b43b1cacde8d403"
        },
        {
          "url": "https://git.kernel.org/stable/c/9e6869be49064915edb6c8776b27c376cfdb0df5"
        }
      ],
      "title": "net/dibs: Correct freeing of dmb_clientid_arr",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74629",
    "datePublished": "2026-08-22T15:32:10.861Z",
    "dateReserved": "2026-08-15T05:44:03.921Z",
    "dateUpdated": "2026-08-25T05:40:53.253Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74629",
      "date": "2026-09-16",
      "epss": "0.00239",
      "percentile": "0.15115"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-74629\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-22T16:16:35.840\",\"lastModified\":\"2026-08-25T06:18:41.710\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/dibs: Correct freeing of dmb_clientid_arr\\n\\nA dibs device interrupt handler can be active after dibs_dev_del() and\\nmay still access dmb_clientid_arr. (UAF)\\n\\nIn case of a failure in dibs_dev_add() being called by dibs_lo_dev_probe()\\ndmb_clientid_arr is freed twice (double free).\\n\\nFree dmb_clientid_arr in dibs_dev_release() after last reference is gone.\\nNote that allocating in dibs_dev_add() instead of dibs_dev_alloc() is ok\\nfor now, because no dmbs can be registered before dibs_dev_add().\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/dibs/dibs_loopback.c\",\"drivers/dibs/dibs_main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"cc21191b584c6f7836b0f10774f8278b7cbfba10\",\"lessThan\":\"ece6426b61241e9bfb41aa131f235168f55229b1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cc21191b584c6f7836b0f10774f8278b7cbfba10\",\"lessThan\":\"7a1df20a8d2cc89e3a442b6e0b43b1cacde8d403\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cc21191b584c6f7836b0f10774f8278b7cbfba10\",\"lessThan\":\"9e6869be49064915edb6c8776b27c376cfdb0df5\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/dibs/dibs_loopback.c\",\"drivers/dibs/dibs_main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.45\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.9\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/7a1df20a8d2cc89e3a442b6e0b43b1cacde8d403\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9e6869be49064915edb6c8776b27c376cfdb0df5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ece6426b61241e9bfb41aa131f235168f55229b1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-25T08:51:42+00:00",
      "cve": "CVE-2026-74629",
      "id": "CVE-2026-74629",
      "initial_release_date": "2026-08-22T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net/dibs: Correct freeing of dmb_clientid_arr",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74629.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-05T00:28:53Z",
      "cve": "CVE-2026-74629",
      "id": "CVE-2026-74629",
      "initial_release_date": "2026-08-23T00:05:40Z",
      "product_status:known_not_affected": "357",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74629",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74629.json",
      "version": "5"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.