CVE-2026-74690
Description
A flaw was found in the Linux kernel's s390/ism component. An interrupt handler could concurrently access data structures (sba and ieq) that have already been freed during the ism_dev_exit() process. This Use-After-Free (UAF) vulnerability could lead to system instability or potentially allow for privilege escalation.
Statement
A race in the s390 ISM driver can allow an interrupt handler to run in parallel with ism_dev_exit while sba and ieq data structures are being released. This creates a use after free condition in the interrupt path because an already active handler may still access those objects after they are freed. For the CVSS the PR:L in the paranoid vector represents an attacker or service account that can trigger driver unbind, reset, module unload, or device teardown through delegated administration rather than full host root. The issue is not directly network reachable and requires local control over the affected device lifecycle or a closely related management path. Impact is at least local denial of service via kernel crash and in worst case may allow confidentiality or integrity impact due to kernel memory corruption, so it should be reviewed manually.
Mitigation
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.7 | N/A | 8.4 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | High | N/A | Low |
| Privileges Required | Low | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | High |
| Integrity Impact | None | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
